Dropbox dropbox.com Dropbox data breach 2012: what happened and what to do
In mid-2012 attackers stole Dropbox user credentials. In 2016 more than 68 million records, with email addresses and hashed passwords, were traded online. Dropbox forced password resets for accounts it thought were at risk.
View all 13,115 breaches- Breach date
- Jul 2012
- Affected
- 68,648,009
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Dropbox was breached in July 2012. The scale stayed hidden for four years. In August 2016, Dropbox forced password resets for users it believed could be at risk, and shortly afterwards a large file of Dropbox credentials was traded online. Reporting at the time said the attackers got in using a password stolen from an employee, which led to a document with user email addresses.
Have I Been Pwned (HIBP) loaded the file on 31 August 2016. It contained 68,648,009 records. Each had an email address and a hashed password. About half of the hashes used SHA1, a weak, older method, and about half used bcrypt, which is much harder to crack.
Dropbox said it had no sign that any account had been improperly accessed. It also said passwords from before mid-2012 could not be used to get into accounts, because those had been reset.
What was exposed
Two things: email addresses and password hashes. A hash is a scrambled form of the password, and a stronger hash is harder to reverse. The bcrypt ones were far more likely to hold up. The SHA1 ones are easier to crack, particularly for common or short passwords.
The long-term risk is credential stuffing. Criminals take a leaked email and password and try them on other sites such as email, banking and shopping. If you used the same password on any of those in 2012, that password is a problem today, whether or not Dropbox itself was safe.
The company's response
Dropbox forced password resets for users who hadn't changed their password since mid-2012, and said it was a precaution. This is the main thing to know: if you signed up before 2012 and have changed your password since, you are in a much better position.
What to do now
Check your email on HIBP. If Dropbox is listed, think about every place you may have reused that old password. Change them all, and use a password manager so that each site has its own.
What to do if you were in it
- 1
Change your Dropbox password
If you haven't changed it since 2012, do it now. Choose a long, unique password from a password manager.
- 2
Change any site where you reused that password
Start with email, banking and shopping accounts. Attackers try leaked passwords on other sites automatically.
- 3
Turn on two-factor authentication
Add 2FA to Dropbox and to your email. An authenticator app or a security key beats text messages.
- 4
Expect phishing
Your email address was exposed. Treat messages that claim to be from Dropbox with care and go to the site directly instead of using links.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It looks for your email and phone number in breach databases and on the dark web, and alerts you if they show up. Breach data can't be taken down, so the scan tells you what to change instead.
Frequently asked
Was I affected by the Dropbox breach?
Search your email on Have I Been Pwned. If Dropbox is listed, your email and a hashed password were in the data of 68,648,009 records.
What was exposed?
Email addresses and salted password hashes, about half SHA1 and half bcrypt.
Should I change my password?
Yes, if you haven't changed it since 2012, and also on any other site where you used the same password.
Did Dropbox respond?
Yes. In 2016 it forced password resets for users it believed were at risk, and said it knew of no accounts improperly accessed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
