Dashlane says hackers stole password vaults via a 'brute force attack'

Summary

Hackers accessed approximately 20 Dashlane password vaults via brute-force attacks on two-factor authentication. Dashlane states internal systems were not compromised and has blocked threat actor traffic, recommending users review account devices and strengthen passwords.

Key Takeaways

1. Hackers were able to download copies of the password vaults of around 20 users, though Dashlane notes that vault data is encrypted unless they have access to a user's Master Password.
2. The hackers didn't gain access to the password vaults by compromising Dashlane's internal systems, according to a Dashlane status page that documented the attack.
3. Users impacted by the attack have been notified.

Statement Breakdown

• Claimed Facts: 60% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 20% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on information provided by Dashlane, a company directly involved in the incident. While Engadget attempts to verify details, the primary source of information is the company itself. The article acknowledges the need for further information, indicating a degree of caution.

Bias assessment: Tech-Focused Reporting. The article's perspective is centered on the technical aspects of a cybersecurity incident. It prioritizes explaining the 'how' of the attack and the company's response, reflecting a neutral, informative stance typical of technology news outlets.

Note: This article reports on a cybersecurity incident based on statements from the affected company, Dashlane. Verify details with official company statements and security advisories.

Credibility flag: Information from company

Claimed Facts (7)

• This is a direct statement of fact from the company about the incident.
• This statement provides specific information about the method of attack, attributed to a Dashlane status page.
• This is a direct quote from Dashlane explaining the attackers' objective.
• This describes the technical method used in the attack, attributed to Dashlane's analysis.
• This explains a security measure that was triggered during the attack.
• This is a factual statement about the communication process with affected users.
• This is a factual statement about actions taken to stop the attack.

Opinions (3)

• While stating a fact about the number of vaults, the 'unless they have access to a user's Master Password' part introduces a conditional element that leans towards an explanatory opinion on security.
• The use of 'likely' and 'basically' indicates an interpretation or educated guess about the attackers' methods, rather than a definitively proven fact.
• These are recommendations for users, which are advisory in nature and represent the company's opinion on best practices.

Claims (2)

• The title itself is a strong claim that could be interpreted as sensationalized, as the article later clarifies the attack targeted 2FA, not the vaults directly.
• The summary is a simplification that could be misleading, as the article explains the attack targeted 2FA to gain access, not directly brute-forced the vaults themselves.

Key Sources

• Dashlane — Password Manager Company
• Engadget — Technology News Outlet
• Ian Carlos Campbell — Author