Dropbox Sign Breach Exposes All Users' Data, No Major Operational Impact

May 1, 2024, 09:28 PM

Dropbox has reported a significant cybersecurity breach involving its digital-signature product, Dropbox Sign (formerly HelloSign), which occurred on April 24. The breach, affecting all users of the Dropbox Sign environment, exposed sensitive data including emails, usernames, phone numbers, hashed passwords, and key authentication information such as API keys. Despite the breach, Dropbox has stated that the incident is unlikely to have a material impact on its operations, as no core user content or payment information was compromised. The company has filed an 8-K with the SEC to report this cybersecurity incident.