Dropbox Inc. (NASDAQ:DBX) has reported a cybersecurity incident involving unauthorized access to its Dropbox Sign service, previously known as HelloSign. The company became aware of the breach on April 24, 2024, and quickly initiated its incident response protocols to investigate and address the issue.
The investigation revealed that the unidentified threat actor gained access to user information within the Dropbox Sign production environment. Compromised data includes emails, usernames, and general account settings for all users of the service. A subset of users also had their phone numbers, hashed passwords, and authentication details such as API keys, OAuth tokens, and multi-factor authentication information accessed.
Dropbox has clarified that there is no evidence to suggest that the contents of users' accounts, including agreements, templates, or payment information, have been compromised. The incident appears to be isolated to Dropbox Sign, with no indication that other Dropbox product environments have been affected.
In response to the breach, Dropbox has engaged industry-leading forensic investigators to understand the full scope of the incident and to mitigate any potential risks to its users. The company has also notified law enforcement and is in the process of informing regulatory authorities as well as users whose personal information was accessed without authorization.
As of the date of the SEC filing, Dropbox does not anticipate that the incident will have a material impact on its business operations. The company has stated that, based on current information, it does not expect the breach to significantly affect its financial condition or operational results. However, Dropbox acknowledges the risks posed by potential litigation, customer behavior changes, and increased regulatory scrutiny following the incident. Remediation efforts are ongoing to secure the affected systems and prevent future breaches.
This article was generated with the support of AI and reviewed by an editor. For more information see our T&C.