Dashlane Confirms Brute Force Attack Targeting User Accounts On 31 May, password manager Dashlane responded to a brute force attack by an external actor after users reported login difficulties and suspicious account suspension emails. The incident began around 3:00 PM UTC, with initial reports of failed logins and password reset issues prompting an investigation by Dashlane’s engineering team. By 10:30 PM UTC, Dashlane confirmed that a subset of user accounts had been targeted in the attack, triggering automated security measures that temporarily suspended affected accounts. The company stated that the accounts were later unsuspended and that no evidence of a system-wide breach was found. Dashlane attributed the disruptions to its built-in security protocols, which activated in response to the brute force attempts. The attack did not compromise Dashlane’s internal systems, and the company continues to monitor the situation.

Critical Vulnerabilities Exposed in Major Cloud Password Managers Researchers from ETH Zurich’s Applied Cryptography Group have uncovered 25 severe security flaws in popular cloud-based password managers, including Bitwarden, LastPass, and Dashlane, which collectively serve around 60 million users worldwide. The findings challenge the long-held assumption of "zero-knowledge encryption" a security model where data remains encrypted even if servers are compromised. Led by Professor Kenneth Paterson, the team simulated a malicious server threat model, testing how browser extensions responded when servers were compromised. The results revealed client-side vulnerabilities that could allow attackers with server access to view, modify, or delete stored passwords, logins, and sensitive data. Bitwarden was found to have 12 vulnerabilities, LastPass 7, and Dashlane 6, with some flaws enabling full organization vault compromises or unauthorized access via sync manipulation. Key issues stem from outdated cryptographic practices and user-friendly features like password recovery and sharing, which introduce complexity and expand the attack surface. Doctoral student Matteo Scarlata noted that many vendors rely on 1990s-era encryption to avoid disrupting users or causing downtime, undermining the security guarantees of zero-knowledge architectures. The vulnerabilities, assigned CVE IDs with CVSS scores ranging from 7.5 to 8.5, include: - Bitwarden: Unauthorized vault access, integrity violations in shared credentials, and full organization vault compromise. - LastPass: Password recovery bypass and credential modification attacks. - Dashlane: Legacy crypto decryption leaks. The researchers followed responsible disclosure, giving vendors 90 days to address the flaws. While patches are now being rolled out, the findings highlight a critical weakness: even encrypted data can be manipulated if servers are compromised. The incident underscores the need for regular external audits, transparent security practices, and migration to modern cryptographic standards rather than relying on incremental fixes.