Dropbox has confirmed that its recent data breach exposed customer details like hashed passwords and personal information. The exploit targeted the Dropbox Sign eSignature platform which is used by millions to digitally sign documents and send it online.
Dropbox has shared the details about the unauthorised intrusion that was detected on April 24, and it has launched an investigation to get deep into the incident where it found out the root cause of the attack and now claims to have fixed the loophole.
Dropbox Data Breach: What’s The Update
“Upon further investigation, we discovered that a threat actor had accessed data including Dropbox Sign customer information such as emails, usernames, phone numbers and hashed passwords, in addition to general account settings and certain authentication information such as API keys, OAuth tokens, and multi-factor authentication,” Dropbox notified in its warning about the breach.
The post from the platform also talks about the concerns for people who have received or signed a document on the service without creating an account, their email ID and name was also part of the expose. Dropbox assures that just because one of its products was breached, it doesn’t want customers using other services to be worried about this incident and their data is safe.
“The actor compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services,” the post adds.
The good news is that Dropbox has reset the password of all its customers and logged them out of all the signed in devices. Breaches can happen, even to the biggest companies but it is vital they act on it quickly and keep the customer informed about such events like Dropbox has done in the space of 10 days.
Comments
0 comment