Dropbox Accounts Hacked For Spam Campaign

Dropbox has claimed passwords stolen from other websites were used to hack into some of its user accounts, which were subsequently used for spam campaigns.

A “small number” of accounts were compromised, whilst one stolen password was used to access a Dropbox employee’s account, which contained a project document with user email addresses.

“We believe this improper access is what led to the spam. We’re sorry about this, and have put additional controls in place to help make sure it doesn’t happen again,” Dropbox said in a blog post.

Warning signs

The cloud storage company has created a new page to let users see all active logins to their accounts, whilst promoting its other protections such as optional two-factor authentication.

Last month, users complained of increased spam in their Dropbox-associated email inboxes. Dropbox brought in outside help to determine the cause of the spam, claiming it had seen no unauthorised access to accounts.

There was no information on Dropbox about where the stolen email addresses had come from. This year has seen various big-name companies have their password databases hacked, including LinkedIn and Nvidia. As many use the same password across different services, it places them at greater risk if one of those services is hacked.

And Dropbox itself was guilty of security failures last year. In summer 2011, a bug affecting the Dropbox authentication mechanism could have allowed anyone to sign into accounts without the need for proper login credentials. The flaw lasted for around five hours before being patched.

Are you a security expert? Try our quiz!