Attacker Accessed Dropbox Sign User Authentication Data in Recent Intrusion

An unidentified attacker recently gained access to a database that held customer information for Dropbox Sign users, including usernames and emails, and authentication information such as API keys, OAuth tokens, and MFA information.

Dropbox on Wednesday disclosed the breach in a notice to the Securities and Exchange Commission and said that it discovered the intrusion on April 24, but did not say when the attacker gained access or how long the intrusion lasted. The company said that there is no …

access api api keys attacker authentication breach customer data database dropbox dropbox sign emails exchange information intrusion keys mfa notice oauth securities securities and exchange commission sign tokens usernames