# Dropbox Sign (HelloSign) production environment breached · pwn.watch

> A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information.

Page: https://pwn.watch/i/dropbox-sign-production-breach · generated 2026-10-22T21:47:37.879Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Dropbox Sign
- Started: 2024-04-24 · closed: 2024-06-21

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/dropbox-sign-production-breach/feed.xml
- JSON Feed: https://pwn.watch/i/dropbox-sign-production-breach/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/dropbox-sign-production-breach.json
- This file: https://pwn.watch/i/dropbox-sign-production-breach/llms.txt

## Updates (newest first)
- 2024-06-21: Dropbox updates its post: investigation concluded, no access to documents or payment info (https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign)
- 2024-04-24: Dropbox becomes aware of unauthorized access to the Dropbox Sign production environment (https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign)

## Fix brief
# Security brief: Dropbox Sign (HelloSign) production environment breached

Source: https://pwn.watch/i/dropbox-sign-production-breach · status: closed (closed Jun 21, 2024) · severity: high · updated Jun 21, 2024

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information.

Severity detail: SaaS breach incl. API keys and OAuth tokens

- Product: Dropbox Sign

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Jun 21, 2024: Dropbox updates its post: investigation concluded, no access to documents or payment info
- Apr 24, 2024: Dropbox becomes aware of unauthorized access to the Dropbox Sign production environment

## Advisories
- [A recent security incident involving Dropbox Sign](https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign) (Dropbox)

---
Machine-readable: https://pwn.watch/i/dropbox-sign-production-breach.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.