The 2017 'zombie files' bug: deleted files reappeared years later
January 2017
In January 2017 files and folders that users had deleted — in some cases as far back as 2009 — suddenly reappeared in their accounts, revealing that 'deleted' data had been retained on Dropbox's servers far longer than its own policy promised.
What happened
In January 2017 a wave of Dropbox users reported that files and folders they had deleted long ago had silently returned to their accounts. The reappearances were not a matter of months: users described folders deleted as far back as 2009 popping back into existence, with timestamps that made clear they had been gone for years.
A Dropbox staffer on the company's support forum explained that a bug had prevented some files from being fully deleted from Dropbox's servers; those files sat in a kind of limbo instead of being purged. While engineers fixed the underlying bug, they 'inadvertently restored the impacted files and folders to those users' accounts.' Dropbox stressed that no third party was involved and that users had not been hacked.
The episode collided directly with Dropbox's stated privacy practice of permanently erasing deleted content after a set retention window (its policy described purging data roughly 60 days after deletion). If files deleted in 2009 could be restored in 2017, that data had clearly persisted for years beyond the promised window — and Dropbox offered no public explanation for why the bug had gone undetected for so long.
Impact
For a storage service, 'delete' is supposed to mean delete. The bug undermined that guarantee in two directions at once: it showed that data users believed was permanently gone had been quietly retained for years, and it forcibly resurrected potentially sensitive, private, or simply unwanted files into accounts and onto synced devices without consent. For anyone who had deleted financial records, personal photos, or confidential documents specifically to be rid of them, the resurrection was a privacy breach of trust — and a reminder that on a server-side service, users do not actually control the lifecycle of their own data.