Ranked
The worst Dropbox incidents
A curated ranking of the most serious entries in the archive — weighing scale of harm, how avoidable each was, and how long the fallout lasted. Not a raw severity sort; an editorial judgment, with the reasoning shown.
- 1Critical2012 (disclosed in full 2016)
The 2012 breach: 68 million user credentials stolen via a reused password
The foundational breach: ~68M credentials stolen, not fully disclosed until 2016, still being re-weaponized in the 2024 'Mother of All Breaches.' Its consequences never really ended.
Read the documentation → - 2CriticalJune 2011
The 2011 authentication bug: any password unlocked any account
For about four hours, any password unlocked any account. A total collapse of authentication — the single most complete security failure in Dropbox's history.
Read the documentation → - 3High2011–2026 (ongoing)
Dropbox holds the keys: the design choice behind every privacy controversy
Not an incident but the design decision beneath most of them: Dropbox holds your keys, so a breach, a subpoena, or its own staff can reach readable files. The root cause of the privacy and government-access record.
Read the documentation → - 4CriticalApril–May 2024
The 2024 Dropbox Sign breach: e-signature data exposed
The most recent major breach: emails, usernames, phone numbers, hashed passwords, and authentication data (API keys, OAuth tokens) exposed — triggering class actions that were later forced into individual arbitration.
Read the documentation → - 5Critical2014
The 2014 Selective Sync bug that permanently deleted users' files
A Selective Sync bug permanently deleted users' files with no recovery — the archive's clearest case of the core promise (your files are safe) failing outright.
Read the documentation → - 6HighMay 2014
The 2014 shared-link leak: 'private' documents exposed via referer headers and search
Shared-link handling leaked private documents to third parties via referrer headers — confidential files exposed through a design oversight, not an attack.
Read the documentation → - 7HighAugust 2016
2016: Dropbox force-resets passwords as the 2012 breach finally surfaces
The moment the 2012 breach's true scale finally surfaced, forcing a mass password reset four years late — the textbook example of delayed breach disclosure.
Read the documentation → - 8HighMay 2011
The 2011 FTC complaint: a researcher accuses Dropbox of misleading users about encryption
An FTC complaint alleging Dropbox misrepresented its encryption — the earliest formal challenge to the gap between Dropbox's security marketing and its actual architecture.
Read the documentation → - 9HighMarch 2018
The CLOUD Act (2018): a US warrant can reach your files wherever they sit
Codified that U.S. legal process can reach Dropbox-held data stored anywhere in the world — the jurisdiction risk that makes server-held keys matter in practice.
Read the documentation → - 10HighAugust 2015
Man-in-the-Cloud: stealing Dropbox sync tokens to hijack accounts without a password
Demonstrated that stealing a sync token — no password needed — hands an attacker silent, persistent access to a victim's files.
Read the documentation → - 11HighAugust 2023
The 2023 walk-back: Dropbox ends the 'as much space as you need' Advanced plan
Dropbox sold 'as much space as you need,' then retroactively capped it — the sharpest bait-and-switch in the pricing record.
Read the documentation → - 12HighOctober 2024
The 2024 layoffs: cutting 20% of staff while pivoting to AI and Dash
A fifth of the company cut to fund an unproven AI pivot — the steepest single round in a multi-year workforce compression, and the human cost behind the efficiency story.
Read the documentation →
Ranking is Dropbox Watchdog's editorial judgment, drawn from the sourced archive. Reasonable people will order these differently — every entry links to the full, cited documentation so you can weigh it yourself. Dropbox Watchdog is independent and not affiliated with Dropbox, Inc.