An attacker compromised the production environment of Dropbox Sign (formerly HelloSign), exposing customer emails, usernames, phone numbers, hashed passwords, and authentication secrets including API keys, OAuth tokens, and MFA data.
2025: Dropbox forces the Sign-breach class action into private arbitration
A federal judge compelled the users suing over the 2024 Dropbox Sign breach into individual arbitration — finding that by clicking 'I agree' to sign a document they had accepted Dropbox's terms — and then denied reconsideration, effectively shutting the class action out of court.
After Dropbox disclosed the April 2024 Dropbox Sign breach, affected users filed proposed class actions in federal court alleging Dropbox negligently failed to protect their data and did not give prompt, adequate notice; the claims are allegations and the consolidated litigation followed in the Northern District of California.
Dropbox Sign for integrators: the HelloSign rebrand, then a breach that rotated their keys
The HelloSign API was rebranded to the Dropbox Sign API in 2022, and after the 2024 Dropbox Sign breach the company rotated API keys and OAuth tokens — meaning developers who had embedded e-signature functionality had to update credentials and re-establish connections, not just rename a product.
Guiffre v. Dropbox: the class action over the 2024 Dropbox Sign breach
Within weeks of the Dropbox Sign breach disclosure, users filed a proposed class action in California federal court alleging Dropbox failed to protect their data and was slow to notify them.
Following the 2024 Dropbox Sign breach, affected users filed proposed class-action lawsuits accusing Dropbox of failing to secure their data and of notifying victims too slowly. Dropbox has contested the claims, arguing the exposed data poses no identity-theft risk.
Dropbox Sign (formerly HelloSign) is sold as a wholly separate subscription — a free tier capped at three documents per month, then Essentials at about $15, Standard at about $25, and Premium at roughly $40 per user per month — so existing Dropbox storage customers must pay again, per seat, to sign documents.
In 2022 Dropbox rebranded HelloSign — the established e-signature service it had acquired in 2019 — as 'Dropbox Sign,' also renaming HelloWorks to Dropbox Forms and HelloFax to Dropbox Fax, folding a recognized independent brand under the Dropbox umbrella.
Before Dropbox acquired HelloSign in 2019, a patent-assertion entity called Digital Verification Systems had sued HelloSign over an electronic-signature patent — one of a wave of near-identical suits — leaving Dropbox to inherit the dispute along with the company.