A recent security incident involving Dropbox Sign

DropBox states an unknown Threat Actor(s) was able to access user e-mails, usernames, account settings, and in some scenarios hashed passwords, phone numbers, API keys, OAuth tokens, and MFA.

Actual SEC filing [https://www.sec.gov/Archives/edgar/data/1467623/000146762324000024/dbx-20240429.htm](https://www.sec.gov/Archives/edgar/data/1467623/000146762324000024/dbx-20240429.htm) and DropBox announcement [https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign](https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign)

access account actor api api keys dropbox dropbox sign hashed passwords incident keys mails mfa numbers oauth passwords phone phone numbers privacy security security incident settings sign states threat threat actor tokens usernames