What Was Stolen
On April 24, 2024, Dropbox disclosed that attackers had breached the production environment of Dropbox Sign. The entry point was a service account with elevated privileges. Beyond usernames, email addresses, and hashed passwords, attackers obtained: phone numbers, multi-factor authentication configuration, OAuth tokens, API keys, and anyone who had logged in with Google OAuth had their Google OAuth token exposed.
"On April 24 we became aware that a threat actor accessed the Dropbox Sign production environment... and accessed customer information."
— Dropbox Security Advisory, April 2024
A Pattern of Breaches
The 2024 breach is the third major security incident Dropbox has disclosed since 2012. 2012: 68 million passwords stolen. 2022: GitHub repositories accessed via phishing. 2024: Production environment breached via a privileged service account, exposing 700,000+ records including OAuth tokens. The OAuth tokens stolen in 2024 are particularly significant — unlike hashed passwords, they are immediately usable to impersonate account holders to third-party services.
A Breached Cloud Account Yields Only Ciphertext
With 1Cryptor, even stolen OAuth tokens give an attacker nothing useful. The files in your cloud storage are AES-256-GCM ciphertext. The key is derived from your passphrase using Argon2id — it was never on the cloud provider's servers, and it cannot be compelled or stolen from them.