Data breach
DropBox.com data breach
In 2012, DropBox.com suffered a data breach affecting 68,675,904 records. Exposed data included email addresses and passwords.
Breach date
68.7 million
Records in the breach
2
Types of data exposed
Were you affected by the DropBox.com breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the DropBox.com breach
- Email Addresses
- Passwords
About the breach
Major security incidents involving Dropbox include the August 2026 Lenovo ID integration flaw, the 2024 Dropbox Sign breach, and the 2012 credential exposure.
1. August 2026: Lenovo ID Integration Breach
• What Happened: Between August 4 and August 21, 2026, hackers accessed approximately 5,000 Dropbox accounts, viewing or downloading files in less than a third of them.
• Cause: An authentication vulnerability linked to Lenovo ID allowed attackers to register a Lenovo ID using a victim's email address. Because Dropbox trusted Lenovo ID for login verification without requiring a secondary Dropbox password or multi-factor authentication (MFA), attackers gained unauthorized entry.
• Response: Dropbox expired sessions authenticated via Lenovo ID, severed the integration, mandated direct Dropbox passwords, and notified affected users and regulators.
2. April 2024: Dropbox Sign (HelloSign) Breach
• What Happened: In April 2024, threat actors compromised a back-end service account in the Dropbox Sign production environment.
• Data Exposed: Customer emails, usernames, phone numbers, hashed passwords, general account settings, API keys, OAuth tokens, and MFA information. Document contents and payment information were not accessed.
• Response: Dropbox reset passwords, rotated API keys and OAuth tokens, and notified impacted users.
3. November 2022: GitHub Code Repository Breach
• What Happened: Attackers used phishing to steal employee credentials, accessing Dropbox's GitHub organization and exfiltrating 130 code repositories.
• Impact: The stolen code contained embedded API keys, though core user data storage was not directly breached.
4. 2012 / 2016: Historical Credential Breach
• What Happened: A 2012 breach exposed over 68 million (subsequently indexed as ~87 million) customer credentials (email addresses and salted/hashed passwords).
• Response: Dropbox forced password resets in August 2016 for accounts that hadn't changed passwords since the incident.
1. August 2026: Lenovo ID Integration Breach
• What Happened: Between August 4 and August 21, 2026, hackers accessed approximately 5,000 Dropbox accounts, viewing or downloading files in less than a third of them.
• Cause: An authentication vulnerability linked to Lenovo ID allowed attackers to register a Lenovo ID using a victim's email address. Because Dropbox trusted Lenovo ID for login verification without requiring a secondary Dropbox password or multi-factor authentication (MFA), attackers gained unauthorized entry.
• Response: Dropbox expired sessions authenticated via Lenovo ID, severed the integration, mandated direct Dropbox passwords, and notified affected users and regulators.
2. April 2024: Dropbox Sign (HelloSign) Breach
• What Happened: In April 2024, threat actors compromised a back-end service account in the Dropbox Sign production environment.
• Data Exposed: Customer emails, usernames, phone numbers, hashed passwords, general account settings, API keys, OAuth tokens, and MFA information. Document contents and payment information were not accessed.
• Response: Dropbox reset passwords, rotated API keys and OAuth tokens, and notified impacted users.
3. November 2022: GitHub Code Repository Breach
• What Happened: Attackers used phishing to steal employee credentials, accessing Dropbox's GitHub organization and exfiltrating 130 code repositories.
• Impact: The stolen code contained embedded API keys, though core user data storage was not directly breached.
4. 2012 / 2016: Historical Credential Breach
• What Happened: A 2012 breach exposed over 68 million (subsequently indexed as ~87 million) customer credentials (email addresses and salted/hashed passwords).
• Response: Dropbox forced password resets in August 2016 for accounts that hadn't changed passwords since the incident.
How to protect yourself
In order to start protecting yourself from possible fraud in future, we highly recommend the following steps:
1. Immediately change your password on the affected website, but also any other website where you may re-use this password.
2. Download the Google or Microsoft Authenticator App on your mobile device. Activate 2FA authentication on any website you use, which allow for it.
3. Be on aware of an increase in spam or scam e-mails.
1. Immediately change your password on the affected website, but also any other website where you may re-use this password.
2. Download the Google or Microsoft Authenticator App on your mobile device. Activate 2FA authentication on any website you use, which allow for it.
3. Be on aware of an increase in spam or scam e-mails.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.