Breach taxonomy
Summary
On April 24, 2024, Dropbox became aware of unauthorized access to the Dropbox Sign (formerly HelloSign) production environment by a threat actor. The actor accessed data for all Dropbox Sign users including emails and usernames, and for subsets of users also accessed phone numbers, hashed passwords, API keys, OAuth tokens, and multi-factor authentication information. No agreement contents, templates, or payment information were accessed. The incident was limited to Dropbox Sign infrastructure with no impact on other Dropbox products.
Tagging rationale
ThreatUnknown
Filing does not attribute the incident to any specific threat actor → UNKNOWN.
MethodsData Exfil
Filing confirms the threat actor accessed and obtained user data including credentials and authentication information — active data exfiltration.