Dashlane Device Enrollment API Hit by Coordinated OTP Brute-Force Campaign

Attackers exploited Dashlane device registration endpoints to spray one-time codes across thousands of accounts, obtaining fewer than 20 encrypted vaults before automated lockouts triggered. Dashlane confirmed the campaign began Sunday and abused email-delivered six-digit tokens valid for three hours, bypassing per-account rate limits by distributing attempts (Ars Technica, 2026). The company stated all affected personal-plan users received notifications and that Argon2 hashing protects vault contents pending master-password cracks. This approach mirrors documented OTP spraying observed in prior incidents targeting email-linked recovery flows, including the 2022 LastPass vault exfiltration where similar volume tactics succeeded against rate limits (Krebs on Security, 2022). Dashlane’s security documentation emphasizes that tokens must be entered on the enrolling device, yet the incident reveals inadequate cross-account correlation for enrollment API calls. No enterprise accounts were impacted and the automated systems performed as designed once volume thresholds were reached.