People who signed up to popular file hosting and storage service Dropbox before and during 2012 are advised to change their passwords immediately. The advice follows reports a security breach in 2012 may have exposed up to 68 million user credentials.
In a blog post, Dropbox Head of Trust & Security, Patrick Heim, acknowledged the list of email addresses and passwords reportedly leaked recently to a technology website ‘was real’, but said the company had no indication that user accounts had been improperly accessed.
Dropbox first heard about the leaked list of credentials two weeks ago, and started an investigation. Based on Dropbox’s analysis, Heim said, the exposed email addresses and passwords were likely obtained in 2012.
Heim said Dropbox had emailed all affected users and completed a password reset for anyone who had not updated their password since mid-2012. The passwords obtained in the Dropbox breach were ‘hashed’ and ‘salted’, providing a level of protection similar to encryption. This minimises the ability of attackers to use them to gain access to accounts and any stored files.
Staying safe
While the risk to user information is lower when a breach involves hashed and salted passwords rather than unprotected passwords, you should still change your password and always monitor your account for unauthorised activity.
If you signed up to Dropbox before 2012 and reused your Dropbox password on any other website, you should immediately change that password. An attacker may crack some of the leaked passwords and try them on other websites to see if they can gain access to user accounts. Passwords should not be used across multiple websites. Doing so increases the potential damage if a password is obtained by a malicious person or group.
Dropbox also offers two step verification
