The 2012 breach: 68 million user credentials stolen via a reused password

In 2012 attackers obtained the credentials of a Dropbox employee — a password the employee had reused on LinkedIn, which had itself been breached. Using that access, the attackers reached a document containing user email addresses and, as later became clear, a file holding the account credentials of around 68 million users. At the time, in mid-2012, Dropbox acknowledged only that a stolen employee password had been used to access a project document containing user email addresses, which it linked to a wave of spam.

The true scope stayed hidden until August 2016, when a file of hashed credentials began circulating and Dropbox confirmed it was genuine. In a post titled 'Resetting passwords to keep your files safe,' published by Patrick Heim, Dropbox's Head of Trust & Security, and updated on 31 August, the company wrote: 'Since our original post, there have been many reports about the exposure of 68 million Dropbox credentials from 2012. The list of email addresses with hashed and salted passwords is real, however we have no indication that Dropbox user accounts have been improperly accessed.' It said it was 'requiring anyone who hasn't changed their password since mid-2012 to update it the next time they sign in,' and pointed to its wider security practices: 'we build open source tools such as zxcvbn, use bcrypt password hashing, and offer Universal 2nd Factor authentication to all users.'

Security researcher Troy Hunt, who runs the breach-notification service Have I Been Pwned, independently examined the leaked dataset and confirmed it was genuine in a post titled 'The Dropbox hack is real': 'Earlier today, Motherboard reported on what had been rumoured for some time, namely that Dropbox had been hacked. Not just a little bit hacked and not in that "someone has cobbled together a list of credentials that work on Dropbox" hacked either, but proper hacked to the tune of 68 million records.' He found the data split between two hashing schemes: 'It's a relatively even distribution of the two which appears to represent a transition from the weaker SHA variant to bcrypt's adaptive workload approach at some point in time... the bcrypt accounts include the salt whilst the SHA1 accounts don't.' His own email was in the dump, but his password had already changed since 2014; his wife's account, unchanged since April 2012, let him crack a bcrypt hash directly, and he wrote that the result left 'no doubt whatsoever that the data breach contains legitimate Dropbox passwords.' Hunt put the final count at 'now 68,648,009 Dropbox accounts searchable in HIBP.'