Issues Database

Entangled Media sued Dropbox over two patents on cloud-based file systems; the patent office declined to review the patents, and in 2025 the court issued a mixed summary-judgment ruling, leaving the dispute contested rather than resolved.

In 2022 Dropbox rebranded HelloSign — the established e-signature service it had acquired in 2019 — as 'Dropbox Sign,' also renaming HelloWorks to Dropbox Forms and HelloFax to Dropbox Fax, folding a recognized independent brand under the Dropbox umbrella.

Many third-party integrations request broad, full-Dropbox access rather than scoped, folder-limited permissions — so a single connected app, if compromised, can expose everything in an account.

A phishing campaign impersonating the CI provider CircleCI tricked Dropbox employees into handing over credentials and 2FA codes, letting attackers copy 130 of Dropbox's private source-code repositories.

ESET and Avast documented the Worok espionage group's 'DropBoxControl' backdoor, which abused the Dropbox API as its entire command-and-control channel — reading commands from, and uploading stolen data to, ordinary files in a Dropbox account.

Dropbox's forced migration to Apple's File Provider framework on macOS Monterey and Ventura brought runaway CPU usage, stalled syncing, and reports of locally available folders silently reverting to online-only — experienced by some users as data loss.

Dropbox's API lets connected third-party apps request 'Full Dropbox' access to a user's entire account, and broad OAuth scopes mean an app users link for one task can often read far more than they expect.

Dropbox laid off about 11% of its workforce — roughly 315 employees — in January 2021, citing the need to flatten the organization and invest in growth, and replaced the head of its HelloSign unit.

Dozens of current and former Dropbox employees — many women of color — alleged systemic gender disparities in pay, promotion, and treatment, in a report compiled by a former staff researcher that Dropbox strongly contested.

After Apple Silicon Macs shipped in late 2020, Dropbox went nearly a year without a native build, forcing its always-on sync daemon to run under Rosetta 2 emulation — to mounting user fury — before committing to a native release in 2022.

On 30 September 2021 Dropbox stopped issuing the never-expiring access tokens many integrations relied on, switching to short-lived tokens plus refresh tokens — backups, scripts, and self-hosted tools that hard-coded a static token broke unless rewritten.

Dropbox's own Transparency Report shows that a large share of the search warrants it receives arrive with indefinite non-disclosure orders, leaving the company unable to ever notify those users that the government took their data.