Password manager Dashlane disclosed that encrypted vaults belonging to 20 users were stolen, but the company has released few details about the incident or its cause.
Dashlane issued a security advisory confirming that attackers accessed encrypted vaults from a small subset of its user base. The company did not specify when the theft occurred, how attackers gained access, or what information the vaults contained.
In the advisory, Dashlane stated that the affected vaults remained encrypted and that the company had no evidence of decryption. The password manager emphasized that its encryption standards remain unchanged and that users should not face immediate risk from the theft.
However, Dashlane declined to answer direct questions about the incident. The company has not disclosed whether it notified affected users, what investigation it conducted, or whether law enforcement was involved. A request for additional details went unanswered.
The sparse disclosure raises questions about Dashlane's transparency practices. Security experts typically expect companies to provide timelines, affected user counts, and details about remediation steps taken after a breach. Dashlane's refusal to elaborate on these points limits users' ability to assess their own risk.
Password managers hold sensitive authentication data, making them high-value targets. A breach affecting even a small number of vaults can have significant consequences if encryption proves vulnerable or if users reuse credentials across services.
Dashlane's silence stands in contrast to standard security disclosure practices, where companies typically provide affected parties with actionable information. The lack of detail may heighten user concerns about what actually occurred and whether the company fully understands the scope of the incident.
Users should monitor their accounts for unauthorized access. Those with Dashlane vaults may consider changing passwords for critical services and reviewing account activity for signs of compromise.
ShinyHunters claims to have breached the FBI and stolen personal information belonging to agents and job applicants. The alleged theft could expose agents and their families to extortion and counterintelligence threats.
An IT mistake at English hospitals resulted in the loss of 11 years of viewing history for maternity patient records. Hospital staff recovered the underlying patient care data, though access logs remain unrecoverable.
A new Windows malware called ClosedQuorum leverages multiple AI models to autonomously decide its attack strategy after gaining system access. The threat uses Google Gemini, DeepSeek, Qwen, and Mistral to determine post-compromise actions.
Researchers have identified stolen credentials as a critical vulnerability threatening America's water infrastructure. The exposed passwords create direct pathways for attackers to access essential systems.