It joins LinkedIn, MySpace, Tumblr, OKCupid, and Spotify ( x2), among others. In the grand scheme of things, this breach is just another one to add to the ever-growing list of data dumps from megasites. Given that this story is still developing, I suggest keeping tabs on Threatpost they’ll have rapid coverage should things change. What does this mean?Īccording to Motherboard’s report, the Dropbox data dump is not currently listed on the major dark web marketplaces, presumably because when passwords are adequately secured, their value to criminals diminishes.

Of the 68 million-plus accounts, approximately 32 million are secured with bcrypt the rest are hashed with SHA-1. In the post, Motherboard noted that Dropbox had not seen evidence of malicious account access. Last night, Motherboard reported that the databases making their way around the database trading community were real and comprised more than 68 million Dropbox accounts. Four years later, the full extent of the breach is now coming to light after a cache of Dropbox user credentials was discovered online.

At the time of his post, Dropbox called the move “purely a preventative measure.”īack in 2012, Dropbox was the victim of a security breach that caused headaches and spam for users of the service. Earlier this week, my colleague Chris from Threatpost penned an article about how Dropbox forced a password reset for users who had not changed their passwords since 2012.

Dropbox passwords users rolls out just