2024 Dropbox Sign breach — emails, hashed passwords, API keys
Data compromised
Emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens
Technical writeup
Dropbox discovered unauthorized access to Dropbox Sign (formerly HelloSign) production environment. A threat actor compromised a back-end service account and accessed the customer database. Exposed: email addresses, usernames, phone numbers, hashed passwords, API keys, OAuth tokens, MFA data. Document contents and payment info were not accessed.
Root cause
Compromised back-end service account