Dashlane Password Manager user gets locked out due to brute force attack

A number of Dashlane customers have been locked out of their accounts after brute power assaults tried to log in from distant places or unknown gadgets.

In an announcement to BleepingComputer, the password administration service confirmed that the suspension is a part of an automatic safety response designed to guard towards account hijacking.

“We will verify that sure Dashlane person accounts have been the goal of a brute power assault by an exterior get together, leading to these accounts being suspended as a part of Dashlane’s built-in safety controls. The affected accounts have now been unsuspended,” mentioned Jordan Filorenko, Dashlane Senior Director of Company Communications.

“Our groups are actively engaged on this subject and have taken steps to additional shield our clients. There isn’t any proof that Dashlane’s methods have been compromised.”

Involved Dashlane customers took to Reddit at present to report that that they had acquired notifications of suspicious entry requests from abroad. The e-mail contained a verification code for approved account holders to register a brand new machine.

Many customers have been confused as a result of that they had not initiated the request and tried to find out whether or not the communication was a part of a phishing marketing campaign concentrating on Dashlane customers.

Hours later, Dashlane responded to a part of the Reddit thread, saying its methods have been safe and that the exercise was the results of a brute power assault, which entails making an attempt a number of passwords in succession to achieve entry to an account till the proper one is discovered.

A safe platform implements safeguards resembling fee limiting, CAPTCHA challenges, and account lockouts to dam automated assaults after a threshold of failed makes an attempt is reached.

In response to Dashlane’s standing web page, the investigation into the incident started on Could 31 at 15:19 UTC, and by 22:30 UTC the problem was marked as “resolved” and all affected accounts claimed to have been unsuspended.

A separate replace issued on June 1st at 07:32 UTC confirmed an analogous state of affairs, and the Dashlane crew confirmed that it’s monitoring the state of affairs and implementing extra focused measures.

Regardless of the platform reporting the problem as resolved, some customers proceed to report login points and say assist is unresponsive.

BleepingComputer has requested extra inquiries to Dashlane about this incident to find out the variety of accounts affected, however the firm has not supplied a solution on the time of publication.