Dropbox Sign Breach Exposes User Data: Investigation and Response Underway
Dropbox, the cloud storage services provider, disclosed a significant breach affecting its digital signature service, Dropbox Sign (formerly known as HelloSign). This breach, discovered on April 24, 2024, resulted in unauthorized access by unidentified threat actors to user emails, usernames, and general account settings associated with all users of the digital signature product. Additionally, for certain subsets of users, the attackers accessed phone numbers, hashed passwords, and authentication information such as API keys, OAuth tokens, and multi-factor authentication details.
The breach extends its impact beyond just Dropbox Sign users, as third parties who received or signed documents through Dropbox Sign but didn't create accounts themselves have also been affected, exposing their names and email addresses. Despite the severity of the breach, the investigation conducted so far has not found evidence suggesting that the attackers accessed the contents of users' accounts, including agreements, templates, or payment information.
The breach is reported to be confined to the infrastructure of Dropbox Sign, with no indication of intrusion into other Dropbox services. The attackers exploited a service account within the Dropbox Sign backend, leveraging its elevated privileges to access the customer database.
In response to the breach, Dropbox has taken immediate security measures, including resetting users' passwords, logging them out of connected devices, and coordinating the rotation of all API keys and OAuth tokens. Furthermore, the company cooperates with law enforcement and regulatory authorities to comprehensively address the breach.
Despite these efforts, the breach marks the second such incident targeting Dropbox within two years. In November 2022, the company disclosed a phishing campaign granting unauthorized access to 130 source code repositories on GitHub. The recurrence of security breaches underscores the ongoing challenges tech companies face in safeguarding user data and infrastructure integrity.
Source: https://thehackernews.com/2024/05/dropbox-discloses-breach-of-digital.html