Dropbox has claimed passwords stolen from other websites were used to hack into some of its user accounts, which were subsequently used for spam campaigns.
A “small number” of accounts were compromised, whilst one stolen password was used to access a Dropbox employee’s account, which contained a project document with user email addresses.
“We believe this improper access is what led to the spam. We’re sorry about this, and have put additional controls in place to help make sure it doesn’t happen again,” Dropbox said in a blog post.
The cloud storage company has created a new page to let users see all active logins to their accounts, whilst promoting its other protections such as optional two-factor authentication.
Last month, users complained of increased spam in their Dropbox-associated email inboxes. Dropbox brought in outside help to determine the cause of the spam, claiming it had seen no unauthorised access to accounts.
There was no information on Dropbox about where the stolen email addresses had come from. This year has seen various big-name companies have their password databases hacked, including LinkedIn and Nvidia. As many use the same password across different services, it places them at greater risk if one of those services is hacked.
And Dropbox itself was guilty of security failures last year. In summer 2011, a bug affecting the Dropbox authentication mechanism could have allowed anyone to sign into accounts without the need for proper login credentials. The flaw lasted for around five hours before being patched.
Are you a security expert? Try our quiz!
Suspended prison sentence for Craig Wright for “flagrant breach” of court order, after his false…
Cash-strapped south American country agrees to sell or discontinue its national Bitcoin wallet after signing…
Google's change will allow advertisers to track customers' digital “fingerprints”, but UK data protection watchdog…
Welcome to Silicon In Focus Podcast: Tech in 2025! Join Steven Webb, UK Chief Technology…
European Commission publishes preliminary instructions to Apple on how to open up iOS to rivals,…
San Francisco jury finds Nima Momeni guilty of second-degree murder of Cash App founder Bob…