Dropbox confirmed that it had experienced a data breach incident in November 2022.
After an unknown attacker gained access to credentials, data, and other secrets within their private GitHub code repositories.
Dropbox did admit that the code contained a "few thousand names and email addresses belonging to Dropbox staff," as well as some plain text secrets like API keys and other credentials.
They adopt common security precautions like frequent password changes and turning on MFA for your storage account.
Source: https://purplesec.us/security-insights/dropbox-data-breach/
TPRM report: https://scoringcyber.rankiteo.com/company/Dropbox
"id": "dro121761222",
"linkid": "Dropbox",
"type": "Breach",
"date": "11/2022",
"severity": "80",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Technology',
'name': 'Dropbox',
'type': 'Company'}],
'attack_vector': 'Unauthorized Access to GitHub Repositories',
'data_breach': {'number_of_records_exposed': 'A few thousand',
'personally_identifiable_information': ['Names',
'Email Addresses'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Email Addresses',
'API Keys',
'Other Credentials']},
'date_detected': '2022-11-01',
'description': 'Dropbox confirmed that it had experienced a data breach '
'incident in November 2022 after an unknown attacker gained '
'access to credentials, data, and other secrets within their '
"private GitHub code repositories. The code contained a 'few "
'thousand names and email addresses belonging to Dropbox '
"staff,' as well as some plain text secrets like API keys and "
'other credentials.',
'impact': {'data_compromised': ['Names',
'Email Addresses',
'API Keys',
'Other Credentials'],
'systems_affected': 'GitHub Repositories'},
'initial_access_broker': {'entry_point': 'GitHub Repositories'},
'motivation': 'Theft of Sensitive Data',
'post_incident_analysis': {'corrective_actions': ['Frequent Password Changes',
'MFA for Storage Account'],
'root_causes': 'Compromised Credentials'},
'recommendations': ['Frequent Password Changes', 'MFA for Storage Account'],
'response': {'remediation_measures': ['Frequent Password Changes',
'MFA for Storage Account']},
'threat_actor': 'Unknown',
'title': 'Dropbox Data Breach',
'type': 'Data Breach',
'vulnerability_exploited': 'Compromised Credentials'}