Dropbox Watchdog

Search issues

Search the Dropbox Watchdog archive

An independent public-record archive · 20102026

Dropbox keeps your files. This is the record of when it failed to.

Dropbox Watchdog is a critical, well-sourced archive of the company's documented failures — security breaches, privacy walk-backs, lawsuits, outages and data loss, killed products, and pricing controversies from 2010 to 2026. Every entry is backed by primary sources; Dropbox's own responses are included wherever they exist.

190
Documented issues
1986–2026
Years covered
532
Cited sources
11
Categories

Rigorously sourced

Primary sources first — news reporting, security disclosures, court records, and Dropbox's own statements and blog posts. No claim without a citation.

Critical, not neutral

Structured, searchable, and unflinching. We call out the breaches, broken promises, and growth-over-users decisions directly — and keep every claim verifiable.

Fair to the facts

We document problems factually and include Dropbox's responses and context. Legal claims distinguish allegations from settlements and judgments.

New and updated

Most severe

The most serious documented issues

View all by severity

An attacker compromised the production environment of Dropbox Sign (formerly HelloSign), exposing customer emails, usernames, phone numbers, hashed passwords, and authentication secrets including API keys, OAuth tokens, and MFA data.

Security Incidents & Data BreachesCurrent / Ongoing Issues (2024–2026)
Read documentation
3 sources
Critical8,343 files lost in one documented case

The 2014 Selective Sync bug that permanently deleted users' files

A flaw in Dropbox's desktop Selective Sync feature permanently destroyed the files of users whose client crashed or was force-quit mid-operation — including one photographer who lost more than 8,000 irreplaceable images. Dropbox compensated affected users with a year of Dropbox Pro.

Reliability & Data Loss
Read documentation
4 sources
Critical68,648,009, per Troy Hunt's independent count (Dropbox described it as 'roughly 68 million')

The 2012 breach: 68 million user credentials stolen via a reused password

An attacker used a Dropbox employee's reused password to steal a file containing roughly 68 million users' email addresses and hashed passwords — a theft whose full scale only became public in 2016.

Security Incidents & Data BreachesPrivacy & Encryption Concerns
Read documentation
2 sources
Criticalfewer than a hundred, per Dropbox's final count (initially described as 'much less than 1 percent' of accounts that logged in during the window)

The 2011 authentication bug: any password unlocked any account

For nearly four hours on 19 June 2011, a code update left Dropbox accounts accessible with any password at all — anyone could sign in to any account by typing anything.

Security Incidents & Data BreachesPrivacy & Encryption Concerns
Read documentation
3 sources
Highpaying users 18.07M (down from 18.24M year over year)

Fiscal 2025 results and the flat 2026 guidance: a year of managed stagnation

Dropbox closed fiscal 2025 with revenue of about $2.52 billion, down roughly 1% year over year, paying users down to 18.07 million, and guidance for 2026 of essentially flat revenue — confirming that the core business has stopped growing even as margins expand.

Pricing & Business PracticesCurrent / Ongoing Issues (2024–2026)
Read documentation
9 sources
HighApproximately 5,000 accounts; files accessed in fewer than a third (about 1,500 by 9to5Mac's arithmetic)

The 2026 Lenovo ID sign-in flaw: ~5,000 Dropbox accounts entered without a Dropbox password

A flaw in how Lenovo verified account-holder email addresses let an attacker register a Lenovo ID on a victim's email, and Dropbox's Lenovo ID sign-in link then trusted that identity without ever asking for a Dropbox password — reaching roughly 5,000 accounts.

Security Incidents & Data BreachesCurrent / Ongoing Issues (2024–2026)
Read documentation
The data

Documented issues by year

The archive tracks how Dropbox's problems cluster over time — around major breaches, product shutdowns, pricing changes, and restructurings. Explore the full set of visualizations on the data page.

See all charts
Issues added per year

Browse by category

Security Incidents & Data Breaches

Hacks, stolen credentials, leaked files, and the breaches that exposed Dropbox users and employees.

Privacy & Encryption Concerns

Server-side keys, government access, shared-link leaks, and the gap between Dropbox's privacy promises and its design.

Legal Actions & Lawsuits

Patent fights, class actions, regulatory scrutiny, and the courtroom disputes Dropbox has faced.

Reliability & Data Loss

Outages, sync failures, corrupted files, and the times Dropbox lost or resurrected users' data.

Product Changes & User Backlash

Killed apps, deprecated features, forced migrations, and the product decisions that angered loyal users.

Pricing & Business Practices

Price hikes, 'unlimited' walk-backs, auto-renewal complaints, layoffs, and growth-over-users decisions.

Current / Ongoing Issues (2024–2026)

Live and unresolved problems: the Dropbox Sign breach fallout, AI data questions, layoffs, and more.

Government Access & Surveillance

Government data demands, the PRISM disclosures, the CLOUD Act, content scanning, and the limits of Dropbox's transparency.

Account Lockouts & Support Failures

Sudden account suspensions, files held hostage over quota, automated support loops, and the absence of a human to appeal to.

Developer, API & Platform

Killed APIs, breaking changes, OAuth and rate-limit churn, and a third-party ecosystem repeatedly left to break.

Workplace, Culture & Labor

Discrimination claims, the human cost of repeated layoffs, return-to-office friction, morale, and executive pay against a shrinking workforce.

Featured issues

View all
9 sources
HighApproximately 5,000 accounts; files accessed in fewer than a third (about 1,500 by 9to5Mac's arithmetic)

The 2026 Lenovo ID sign-in flaw: ~5,000 Dropbox accounts entered without a Dropbox password

A flaw in how Lenovo verified account-holder email addresses let an attacker register a Lenovo ID on a victim's email, and Dropbox's Lenovo ID sign-in link then trusted that identity without ever asking for a Dropbox password — reaching roughly 5,000 accounts.

Security Incidents & Data BreachesCurrent / Ongoing Issues (2024–2026)
Read documentation

With revenue flat-to-declining and its AI product Dash still showing no monetization metrics, analysts moved Dropbox to 'sell' — warning that buyback-fueled EPS masks a structurally stalled business.

Pricing & Business PracticesCurrent / Ongoing Issues (2024–2026)
Read documentation
2 sources
Medium1,180+ documented BBB complainants (3-year window)

Over 1,180 BBB complaints: the paper trail of Dropbox's billing and support grievances

The Better Business Bureau has logged more than 1,180 complaints against Dropbox over three years, dominated by surprise auto-renewal charges, denied refunds, and support tickets that vanish without resolution.

Pricing & Business PracticesAccount Lockouts & Support Failures
Read documentation
3 sources
Medium

Winding down Dropbox Passwords: a password manager killed in 2025

Dropbox shut down Dropbox Passwords, the password manager it had launched in 2020, in a phased 2025 wind-down ending 28 October 2025 — after which all stored credentials and payment cards were permanently deleted from its servers.

Product Changes & User BacklashCurrent / Ongoing Issues (2024–2026)
Read documentation
3 sources
HighHundreds of thousands (Sign-breach class, now in arbitration)

2025: Dropbox forces the Sign-breach class action into private arbitration

A federal judge compelled the users suing over the 2024 Dropbox Sign breach into individual arbitration — finding that by clicking 'I agree' to sign a document they had accepted Dropbox's terms — and then denied reconsideration, effectively shutting the class action out of court.

Legal Actions & LawsuitsCurrent / Ongoing Issues (2024–2026)Account Lockouts & Support Failures
Read documentation

A consumer law firm opened an investigation into Dropbox Plus auto-renewals in 2025, as strengthened automatic-renewal laws in California and New York raised the bar for consent, reminders, and easy cancellation.

Legal Actions & LawsuitsPricing & Business PracticesAccount Lockouts & Support Failures
Read documentation