Accounts, sign-in & support

A flaw in how Lenovo verified account-holder email addresses let an attacker register a Lenovo ID on a victim's email, and Dropbox's Lenovo ID sign-in link then trusted that identity without ever asking for a Dropbox password — reaching roughly 5,000 accounts.

If a user enables two-factor authentication and later loses their authenticator app, backup phone and emergency backup code, Dropbox support has told users it has no process to restore access — and the account, with all its files, is effectively lost.

Four years after the 2012 breach, the stolen credentials surfaced in the wild, forcing Dropbox to reset the passwords of all users who had not changed them since mid-2012.

As of November 2026, the Better Business Bureau lists 196 complaints against Dropbox, Inc. in the last three years, led by billing (54) and product (54) issues; 182 are marked "Answered" and 14 "Resolved".

As of 4 November 2026, Dropbox is rated 1.3 out of 5 on Trustpilot (1,611 reviews) and 2.7 out of 5 on SmartCustomer, where the old SiteJabber address now redirects (210 reviews, 61% of them one-star).

In January 2024 a 26-billion-record compilation dubbed the 'Mother of All Breaches' surfaced online — and the 68 million credentials stolen from Dropbox in 2012 were among the datasets bundled into it.

Dropbox Basic (free) users get no email, chat or phone support — only the help center and community forum. Even paying Plus and Professional customers must first pass through a Dropbox AI assistant before they can reach email or live chat.

Dropbox offers no legacy-contact or memorialization feature. To obtain a deceased person's files, the next of kin must generally produce a court order compelling disclosure — a slow, expensive barrier that leaves grieving families locked out of irreplaceable data.

Dropbox teams must always have at least one admin, but when a sole admin leaves, is offboarded, or loses access, the rest of the team can be locked out of administration — and recovering control or transferring ownership often requires a slow special support process.

Dropbox promises a one-business-day email response on paid plans, but users widely report tickets sitting for days, being marked 'solved' without a fix, or being told to use the volunteer community forum — and some say they turned to the BBB after direct requests went unanswered.

Dropbox sends one-time verification codes for new-device or unusual logins, but when the code goes to an outdated phone number or an inbox the user can no longer reach, legitimate owners report being unable to sign in — and the questionnaire-based recovery often fails.

Untested, single-source: Calcalist/CTech reported on 11 August 2026 that a senior physician at an Israeli hospital has sued the Dropbox entity registered in Ireland over an account that, according to the lawsuit, was blocked without prior warning, a hearing or an explanation. He denies ever storing the material Dropbox is said to have cited. None of it has been tested in court, Dropbox had not filed a response when the report appeared, and this entry rests on that one report.