Decision guide
Is Dropbox safe?
A straight answer, drawn from the documented record — not marketing. Here's what's genuinely fine, what isn't, and who should think twice.
The short answer: it depends on what you store.
Dropbox is reliable and reasonably secure for everyday, non-sensitive files. But it holds the keys to your files — meaning Dropbox itself, a breach, or a legal demand can reach readable content. Across 195 documented issues (1986–2026), the recurring risks are the server-held keys, U.S. jurisdiction, a real breach history, and persistent billing/support complaints. For sensitive or regulated data, a zero-knowledge provider is the safer choice.
Last reviewed: 19 September 2026
Think twice / look elsewhere if…
- You store legal, medical, financial, or otherwise regulated/confidential data
- You need the provider to be mathematically unable to read your files (zero-knowledge)
- Data sovereignty or non-U.S. jurisdiction is a hard requirement
- You've been burned by surprise auto-renewals or want reliable human support
Probably fine if…
- You share non-sensitive files and value the collaboration and integration features
- You keep local backups and don't rely on any one product staying alive
- You add client-side encryption (e.g. Cryptomator) for the folders that matter
- You're aware of the billing pattern the archive documents before you subscribeAuto-renewal & refund practices · 1,180+ BBB complaints
- You turn on two-factor authentication and unlink any partner sign-ins you don't use
What actually happened, and when
Every dated entry below has its own sourced page in the archive. Not every row is a "breach" in the strict sense — some are data-loss bugs, a mass password reset, or the server-held-key design itself — but each is a documented, real event or fact, not a rumor.
| Year | What happened | Scale |
|---|---|---|
| 2011 | The 2011 authentication bug: any password unlocked any account For nearly four hours on 19 June 2011, a code update left Dropbox accounts accessible with any password. | Fewer than 100 accounts |
| 2012 | The 2012 breach: 68 million user credentials stolen via a reused password An attacker used a Dropbox employee's reused password to steal roughly 68 million users' email addresses and hashed passwords. | 68,648,009 accounts |
| 2014 | The 2014 shared-link leak: private documents exposed via referer headers and search Shared links to supposedly private documents could leak to third parties through browser referer headers and Google search. | Not disclosed |
| 2014 | The 2014 Selective Sync bug that permanently deleted users' files A flaw in Selective Sync permanently destroyed files when the client crashed mid-operation. | 8,343 files lost in one documented case |
| 2016 | The 2016 mass password reset: forcing millions to re-secure pre-2012 accounts When the full 2012 credential dump resurfaced, Dropbox forced a password reset on millions of users. | All pre-mid-2012 users who hadn't changed their password |
| 2017 | The 2017 'zombie files' bug: deleted files reappeared years later Files deleted as far back as 2009 suddenly reappeared in user accounts. | Not disclosed |
| 2022 | The 2022 phishing breach: 130 internal GitHub repositories stolen Phishing of CircleCI let attackers copy 130 Dropbox private source-code repositories. | 130 repositories; a few thousand names and emails |
| 2024 | The 2024 Dropbox Sign breach: e-signature data exposed An attacker compromised Dropbox Sign production, exposing emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens, and MFA data. | Customer count not disclosed |
| 2024 | Class actions over the 2024 Dropbox Sign breach Users filed class actions alleging negligence and delayed notice. | Ongoing litigation — no new exposure |
| 2026 | The 2026 Lenovo ID sign-in flaw: ~5,000 Dropbox accounts A flaw in Lenovo's email verification let an attacker register a Lenovo ID on a victim's email, gaining Dropbox access without the Dropbox password. | ~5,000 accounts; files accessed in ~1,500 |
| 2011–2026 | Dropbox holds the keys: the design choice Dropbox encrypts files at rest but retains the keys itself, enabling company access to user files — not an incident, but the structural reason incidents can reach file content at all. | Structural — applies to every account |
Two widely repeated claims aren't on this list because they weren't Dropbox breaches: a 2014 report of "7 million stolen logins" traced to credential stuffing from other services, and the 2014 "Snappening" photo leak — sometimes blamed on Dropbox — actually came from third-party Snapchat apps.
Frequently asked
Is Dropbox safe to use?
For everyday, non-sensitive files, Dropbox is broadly reliable and uses strong transport and at-rest encryption. The important caveat is that Dropbox holds the encryption keys to your files, so it can read your content — and so can anyone with a valid legal demand, a successful breach, or sufficient internal access. For sensitive, regulated, or confidential data, that design is a meaningful limitation, and a zero-knowledge provider is safer.
Can Dropbox read my files?
Yes. Dropbox encrypts files at rest but retains the decryption keys, so it can access readable file content when required — for legal process, abuse scanning, or support. This is different from zero-knowledge providers (Sync.com, Proton Drive, Tresorit), where only you hold the keys and the provider mathematically cannot read your files.
Has Dropbox been breached?
Yes. The 2012 breach exposed roughly 68 million user credentials (not fully disclosed until 2016), and the 2024 Dropbox Sign breach exposed customer emails, usernames, phone numbers, hashed passwords, and authentication data (API keys, OAuth tokens). Most recently, between 4 and 21 August 2026 an attacker exploited a flaw in Lenovo's email-verification process to register a Lenovo ID using a victim's email address, then used Dropbox's Lenovo ID account linking to enter roughly 5,000 linked Dropbox accounts without the Dropbox password; files were downloaded from about 1,500 of those accounts, and none of the affected accounts had two-factor authentication enabled. Dropbox removed all Lenovo ID account links, expired the affected sessions, and now requires the Dropbox password when signing in via Lenovo. The archive documents these and other security incidents in full.
Is Dropbox safe for confidential or regulated data?
It depends on your requirements, but for legal, medical, financial, or otherwise regulated data, a zero-knowledge provider is the safer default. Because Dropbox can technically access file content and is a U.S.-jurisdiction company subject to legal compulsion, teams with strict confidentiality or data-sovereignty needs often choose an end-to-end-encrypted alternative — or add a client-side encryption layer like Cryptomator on top of Dropbox.
Should I stop using Dropbox?
Not necessarily. If you value its collaboration features and your files aren't sensitive, the risk from the documented breach history is limited. Separately, the archive records a persistent, years-long pattern of auto-renewal charges and refused refunds, backed by more than 1,180 Better Business Bureau complaints — worth knowing before you subscribe. If privacy, confidentiality, or data sovereignty matter to you, either switch to a zero-knowledge provider or keep Dropbox but encrypt sensitive folders client-side first.
Is Dropbox safe for sensitive documents?
Not ideally. Dropbox holds the encryption keys to every file you store, so for legal, medical, financial, or otherwise regulated or confidential documents, that server-side design — not any single incident — is the central risk. A zero-knowledge provider, where the company itself cannot read your files even under a legal demand, removes that risk entirely.
Is it safe to download files from a Dropbox link?
A genuine dropbox.com share link is a legitimate file host, not inherently dangerous by itself. The same legitimacy makes Dropbox links an effective phishing vehicle, so treat an unexpected link — especially one that asks you to sign in — with the same caution as any unsolicited attachment.
Is Dropbox safer than Google Drive?
That depends on what 'safer' means to you. What the documented record shows clearly is Dropbox's side of it: server-held encryption keys rather than a zero-knowledge design, and a real, multi-incident breach history covered on this site. For a direct, feature-by-feature comparison of both providers' security models, see how they stack up.
How safe is Dropbox from hackers?
The record doesn't show one point of failure — it shows a repeating pattern: the 2012 breach began with a reused employee password, the 2026 Lenovo ID incident exploited a flaw in a partner's sign-in system rather than Dropbox's own password, and phishing pages have used Dropbox's own domain for years to harvest credentials. None of the roughly 5,000 accounts hit in the 2026 incident had two-factor authentication enabled.
Was Dropbox hacked in 2026?
Yes. Between 4 and 21 August 2026, an attacker abused a flaw in Lenovo's own sign-in process — not a flaw in Dropbox's password system — to reach roughly 5,000 Dropbox accounts linked to Lenovo ID, downloading files from about 1,500 of them. Dropbox has since removed all Lenovo ID account links and now requires the Dropbox password at sign-in.
This guide synthesizes the Dropbox Watchdog archive (195 sourced issues). It is informational, not legal or security advice. Dropbox Watchdog is independent and not affiliated with Dropbox, Inc.