Issues Database

Between March 2025 and April 2026 four patent-infringement complaints were filed against Dropbox in the District of Delaware, the Western District of Texas (two suits) and the Southern District of New York. Three were voluntarily dismissed by the plaintiffs within about seven weeks to three and a half months; the fourth, VE Opening, was transferred from Texas to California in July 2026 and is still open. The captured dockets do not show what any court decided on the merits; the VE Opening docket lists a motion for judgment on the pleadings and an order on it whose content was not captured.

Dropbox's Q1 and Q2 2026 results both kept total reported revenue growth under 1% year-over-year, the company refinanced debt and repurchased hundreds of millions of dollars in stock over the same six months, and the period closed with a co-CEO handoff, a new product chief, and a routine, tax-related insider stock disposition reported by the Motley Fool; in September three executives reported sales under Rule 10b5-1 plans adopted in June.

Because some official Dropbox SDKs pinned root certificates, Dropbox's switch to a new certificate root starting 1 January 2026 means apps on the Java, .NET, or Python SDK must upgrade to specific minimum versions or lose access to the API.

Dropbox's own status page logged eleven separate incidents between January and September 2026 — mostly brief, but including a roughly 93-hour shared-content-download degradation in June and an 11-hour, 46-minute Dropbox Protect failure in August.

With revenue flat-to-declining and its AI product Dash still showing no monetization metrics, analysts moved Dropbox to 'sell' — warning that buyback-fueled EPS masks a structurally stalled business.

By the end of 2025 Dropbox employed about 2,113 people — its smallest headcount since 2017, and roughly 32% below its late-2022 peak — one of the steepest sustained workforce reductions among profitable mid-cap software firms.

Untested, single-source: Calcalist/CTech reported on 11 August 2026 that a senior physician at an Israeli hospital has sued the Dropbox entity registered in Ireland over an account that, according to the lawsuit, was blocked without prior warning, a hearing or an explanation. He denies ever storing the material Dropbox is said to have cited. None of it has been tested in court, Dropbox had not filed a response when the report appeared, and this entry rests on that one report.

As of November 2026, the Better Business Bureau lists 196 complaints against Dropbox, Inc. in the last three years, led by billing (54) and product (54) issues; 182 are marked "Answered" and 14 "Resolved".

ConsentFix, an OAuth-consent phishing technique first documented by Push Security in December 2025 and reported on independently through mid-2026, delivers its Microsoft 365 lures through trusted file-hosting platforms — reporting names both Dropbox and DocSend (a Dropbox company) as hosts for the password-protected files attackers use to get past mail filters.

In an 8-K filed May 26, 2026, Dropbox disclosed that co-founder Drew Houston would step back as CEO after 19 years, with the Board appointing Ashraf Alkarmi — its General Manager, Core — as Co-Chief Executive Officer effective that date, ahead of Alkarmi becoming sole CEO and Houston moving to executive chairman 'following a transition period.' The handoff arrives as AI upends the software era Dropbox grew up in and the company's revenue sits near flat.

On 10 September 2026 Dropbox announced, together with OpenAI, a native Dropbox experience inside ChatGPT. Users who connect their account can browse, search, @mention and preview Dropbox files there. Four Dropbox pages captured for this entry describe permissions and a per-user disconnect path, but none of them states whether content sent to ChatGPT is used to train models, how long OpenAI retains it, or any admin switch to block the connector.

Across multiple years, attackers have built convincing fake Dropbox login pages — reached via PDF lures and redirect chains through trusted cloud storage — to harvest victims' real business email and Dropbox credentials.