Dropbox Sign (HelloSign) production environment breached

A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information.

Why this severity: SaaS breach incl. API keys and OAuth tokens

Started

Apr 24, 2024

Closed

Jun 21, 2024

• #Dropbox
• #API keys
• Data breach