Archive — US — techcrunch
Password manager Dashlane says hackers stole some customers’ password vaults
Dashlane reported a cyberattack where hackers accessed up to a dozen customers' encrypted password vaults by brute-forcing the two-factor authentication system. This breach allowed attackers to take over 20 customer accounts, although Dashlane claims its main systems remain secure. The impacted customers have been notified, and the company is investigating the incident while enhancing security measures.
Key points
- Attack method: Hackers brute-forced the two-factor authentication (2FA) system.
- Access gained: Hackers were able to access about 20 customer accounts.
- Outcomes: Up to a dozen encrypted vaults containing sensitive data were stolen.
- Current status: Dashlane claims no compromise of its main systems but hasn't disclosed how the 2FA was defeated.
- Customer notification: Those affected have been informed about the breach.
- Future protections: Dashlane is implementing measures to prevent future incidents.
Why it matters
- This incident highlights vulnerabilities in the cybersecurity landscape, particularly in password management, amidst increasing digitization.
- Historically, breaches in password managers, like LastPass in 2022, show the severe implications such breaches pose, as hackers may exploit weak master passwords.
- Trend: With a growing reliance on password managers, the importance of robust multi-factor authentication and stronger password policies is paramount leading into 2025.
The Dashlane breach serves as a critical reminder of the vulnerabilities in security systems protecting sensitive data. As cyber threats evolve, companies must strengthen their defenses and educate customers on creating robust master passwords to mitigate risks.