Forest Global Training Partners

Cyber Risks · Krebs on Security

Dropbox: Password Breach Led to Spam

Summary: Dropbox confirmed that usernames and passwords stolen from other websites were used to sign in to a small number of Dropbox accounts, and that a stolen password also gave access to an employee Dropbox account holding a project document with user email addresses, which the company believes led to spam sent to Dropbox-specific addresses. A Dropbox spokeswoman said the company was not ready to disclose how many user credentials may have been compromised, and Dropbox said two-factor authentication would arrive in a few weeks alongside automated suspicious-activity detection and a page listing active logins.

What's compelling: A single employee reusing a Dropbox password on a hacked third-party site exposed a project document containing user email addresses, and Dropbox could not say how many credentials were affected while its investigation continued. The controls that would have limited the damage, two-factor authentication and active-login visibility, were still weeks away at the time of disclosure.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related