Dropbox Sign (HelloSign) production environment breached ยท updates https://pwn.watch/i/dropbox-sign-production-breach A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information. en Fri, 21 Jun 2024 00:00:00 GMT Dropbox Sign (HelloSign) production environment breached: Dropbox updates its post: investigation concluded, no access to documents or payment info https://pwn.watch/i/dropbox-sign-production-breach https://pwn.watch/i/dropbox-sign-production-breach#2024-06-21-d0d5e572 Fri, 21 Jun 2024 00:00:00 GMT high <p><a href="https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign">Source</a></p> Dropbox Sign (HelloSign) production environment breached: Dropbox becomes aware of unauthorized access to the Dropbox Sign production environment https://pwn.watch/i/dropbox-sign-production-breach https://pwn.watch/i/dropbox-sign-production-breach#2024-04-24-3cfd2deb Wed, 24 Apr 2024 00:00:00 GMT high <p><a href="https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign">Source</a></p>