Breach exposure

Public breaches involving Dropbox

Cross-matched against the WhatTerms breach catalog. Each entry links the breach disclosure, names the data classes confirmed exposed, and matches each class to a concrete recovery action — not just “your email was leaked”.

Recovery actions

Sorted by severity. Each action maps to one or more data classes confirmed exposed across the breaches below.

Rotate your password on the breached service. Rotate it everywhere you reused it.
High
Hashes are subject to offline cracking — assume it's a matter of time.
Treat SMS 2FA on this number as compromised. Move to TOTP or hardware keys; consider a relay number.
High
Phone numbers feed SIM-swap attacks and SMS phishing.
Switch this service to a per-service email alias and treat the leaked address as compromised.
Medium
Exposed emails feed phishing campaigns and credential-stuffing lists.
Audit accounts where you reuse this handle; assume it can be cross-correlated.
Medium
Handle reuse links pseudonymous accounts back to your real identity.

Dropbox Sign

Disclosed 2024-05-01 · 1.0M accounts

Production environment compromise; user credentials and API keys exposed.

Data classes exposed

Email address
Username / handle
Hashed password
Phone number

Source: Dropbox security advisory and SEC 8-K. Read disclosure ↗