Dropbox Breach Exposes 68.6M Email Addresses and Password Hashes
What Happened — In mid‑2012 Dropbox’s systems were breached, leaking 68,648,009 records that included email addresses and salted password hashes (approximately half SHA‑1, half bcrypt). The company forced password resets for potentially affected users in August 2016, and the stolen data later appeared on underground markets.
Why It Matters for Trust & Control Assurance —
- Credential‑management controls (secure hashing, MFA, password rotation) are designed to prevent exactly this type of exposure and to provide auditable evidence of protection.
- Continuous monitoring of credential health and rapid incident response are essential for a defensible audit trail across frameworks.
- Demonstrable oversight of password‑storage practices signals a mature control‑assurance posture to regulators and partners.
Who Is Affected — Cloud‑storage SaaS providers, their enterprise customers, and any organization that relied on Dropbox for file sharing.
Recommended Actions —
- Enforce MFA and require immediate password changes for all users.
- Verify that password hashing uses strong, adaptive algorithms (bcrypt, Argon2) and document the process for audit readiness.
- Map credential‑management controls to your framework of record and collect evidence of ongoing monitoring.
Technical Notes — Attack vector remains undisclosed; the breach exposed email addresses and salted password hashes (SHA‑1 and bcrypt). Source: https://haveibeenpwned.com/api/v3/breach/Dropbox