Dashlane explains how attackers managed to download encrypted password vaults

Dashlane reported that attackers used a brute force attack on its device enrollment API to download encrypted password vaults from fewer than 20 users before automated security systems locked out the accounts. The attack involved generating valid tokens to register new devices on targeted accounts.