In a November 2012 interview with Forbes, Dropbox CEO Drew Houston said the service had drawn around 100 million users, double from the same a year prior. Even though these passwords have now been dumped online, it does not appear that the hash protections have been cracked. The passwords were also secured with a salt, a random data string added to strengthen the hash. At the time of the breach, Dropbox was moving away from using the hashing function SHA-1, a standard algorithm at the time, and replacing it with the more robust standard called bcrypt. Some of the stolen passwords were hashed with SHA-1, while 32 million were hashed with bcrypt, Motherboard reports. But it does appear that more information was taken from Dropbox than was previously let on, and it’s strange that it’s taken this long for the breach to surface.Īccording to a Dropbox source, in addition to the user emails initially disclosed in 2012, a batch of hashed passwords associated with those emails was also taken. Because Dropbox stores its user passwords hashed and salted, that’s technically accurate - it seems that hackers were only able to obtain hashed files of Dropbox user passwords and were unable to crack them. We’re sorry about this, and have put additional controls in place to help make sure it doesn’t happen again.ĭropbox disclosed in 2012 that an employee’s password was acquired and used to access a document with email addresses, but did not disclose that passwords were also acquired in the theft. We believe this improper access is what led to the spam. Here’s the exact phrasing from the 2012 blog post:Ī stolen password was also used to access an employee Dropbox account containing a project document with user email addresses.

The revelation of a password breach at Dropbox is an evolution of the company’s stance on the 2012 incident - the company initially said that user emails were the only data stolen.

But that number may have been much higher than we originally thought.Ĭredentials for more than 60 million accounts were taken, as first reported by Motherboard and confirmed by TechCrunch sources.

Dropbox disclosed earlier this week that a large chunk of its users’ credentials obtained in 2012 was floating around on the dark web.

Dropbox transfer email spam