Dropbox Reveals Hackers Seized Customer Data and Confidential Secrets from eSignature Service

Dropbox Sign eSignature Platform Breached: What You Need to Know

Cloud storage giant Dropbox recently revealed that hackers managed to breach its Dropbox Sign eSignature platform, getting their hands on authentication tokens, multi-factor authentication (MFA) keys, hashed passwords, and customer information. If you’re not familiar with Dropbox Sign (previously known as HelloSign), it’s a service that enables customers to send documents online for legally binding signatures.

When and How Did the Breach Occur?

We discovered unauthorized access to Dropbox Sign’s production systems on April 24, prompting us to launch an investigation. Our findings showed that the threat actors gained access to a Dropbox Sign automated system configuration tool, which is part of the platform’s backend services. This configuration tool allowed the attacker to execute applications and automated services with elevated privileges, ultimately enabling them to access the customer database.

What Data Was Compromised?

Upon further investigation, we found that the threat actor accessed data such as Dropbox Sign customer information, including emails, usernames, phone numbers, and hashed passwords. Additionally, they got their hands on general account settings and certain authentication information, such as API keys, OAuth tokens, and multi-factor authentication. Unfortunately, even users who used the eSignature platform without registering an account had their email addresses and names exposed.

Was Any Other Data or Services Affected?

While this breach is undoubtedly concerning, the silver lining is that we found no evidence that the threat actors gained access to customers’ documents or agreements. Furthermore, they did not access the platforms of other Dropbox services.

What Measures Have Been Taken to Address This Issue?

In response to the breach, we’ve reset all users’ passwords, logged out all sessions to Dropbox Sign, and restricted how API keys can be used until they are rotated by the customer. We’ve also provided additional information in our security advisory on how to rotate API keys to regain full privileges.

What Should Dropbox Sign Customers Do Now?

If you utilize MFA with Dropbox Sign, you should delete the configuration from your authenticator apps and reconfigure it with a new MFA key retrieved from the website. We’re currently emailing all customers impacted by the incident.

Moreover, be on the lookout for potential phishing campaigns using this data to collect sensitive information, such as plaintext passwords. If you receive an email from Dropbox Sign asking you to reset your password, don’t follow any links in the email. Instead, visit Dropbox Sign directly and reset your password from the site.

Stay Alert and Informed

As cyber threats continue to evolve and become more sophisticated, it’s essential to stay informed and proactive in protecting your data. Remember that in 2022, Dropbox disclosed a security breach after threat actors stole 130 code repositories by breaching the company’s GitHub accounts using stolen employee credentials.

Keep Coming Back to Learn More

With cybersecurity being a top priority for individuals and businesses alike, we encourage you to stay up-to-date on the latest threats and best practices for keeping your data secure. Keep coming back to IT Services to learn more and stay informed about the ever-changing landscape of cybersecurity.