Dropbox Data Breach: What Happened to 68 Million Accounts?
Yes. In 2016, email addresses and hashed passwords associated with about 68 million Dropbox accounts were circulated online after a breach stemming from an employee’s reused password. Dropbox said the exposed passwords were protected with hashing and salting, but affected users were still urged to change their passwords; the incident did not mean that every account was demonstrably accessed or that all account contents were published.
What happened in the Dropbox breach?
The incident became public in August 2016, when Dropbox notified users that it was resetting passwords for accounts that had not changed their password since mid-2012. The company said it had learned of a possible breach and was taking this precaution to protect accounts. Later reporting and security research connected the stolen information to a much larger set of account records, commonly described as approximately 68 million email-and-password pairs.
Dropbox traced the entry point to a Dropbox employee’s account. The employee had reused a password that had been exposed in a separate breach at another service. Attackers used that credential to access a Dropbox document containing user email addresses and hashed passwords. This was a credential-reuse failure: a password stolen from one service became a route into information held at another.
The date matters. This was a historical 2012 incident disclosed publicly in 2016, not evidence by itself of a new Dropbox breach today. Old breach records can continue circulating or be re-uploaded years later, so a report about the data appearing online does not establish when a particular copy was posted or whether any individual account remains vulnerable.
What information was exposed?
The widely reported dataset contained email addresses and password hashes. A hash is the output of a one-way mathematical process intended to let a service check a password without storing the original password in readable form. Dropbox said the passwords were salted and hashed using bcrypt, a password-hashing method designed to make guessing more costly than ordinary fast hashes.
That protection is important, but it is not equivalent to having no password risk. Attackers can try candidate passwords against stolen hashes, especially when a password is short, common, or reused. Strong, unique passwords are harder to guess, while weak or repeated ones may be more exposed to offline cracking attempts.
Public descriptions of the breach generally refer to account credentials, not a dump of every user’s files. Dropbox said the incident involved account information; claims that all stored files were leaked are not supported by the commonly documented facts. As with any breach, however, users should not infer that their account was safe merely because file contents were not the main reported data.
How the incident affected users
Dropbox’s 2016 password reset was a protective measure for accounts whose passwords had not changed since the period associated with the breach. A forced reset can be disruptive, but it prevents an old exposed password from continuing to work on the service. Users who received a reset prompt should have followed the official account-recovery process rather than links in unexpected messages.
For people who used the same password elsewhere, the larger concern was password reuse. A password exposed from Dropbox could be tried on email, banking, shopping, or social accounts if the person had reused it. The sensible response is to change reused credentials everywhere they remain in use, prioritizing the email account that controls password resets for other services.
- Use a different, long password for each account; a reputable password manager can generate and store unique passwords.
- Enable two-step verification where available, so a password alone is not enough to sign in.
- Check account security or device-session settings and remove sessions or connected devices you do not recognize.
- Be cautious of messages asking you to “confirm” a password or download an attachment; navigate to the service directly instead.
What to do if you think your account is affected
Because this breach is old, the most useful question is not just whether an address appears in a historical dataset, but whether the password is still used anywhere. If you have used the same password since 2012—or reused it on another service—replace it now with a new, unique one. Do not modify an old password only slightly; attackers often test predictable variations.
- Go directly to Dropbox’s website or app and sign in through the normal route. If you cannot sign in, use its official account recovery process.
- Change the Dropbox password to a unique one, and update any other account where that old password was reused.
- Turn on two-step verification if offered for your account, and keep recovery information current.
- Review recent security activity, linked devices, and connected apps. Revoke access you do not recognize, then sign out of sessions you no longer use.
- Secure the email account tied to Dropbox, since control of that inbox can often be used to reset other passwords.
A breach-notification or password-checking service may help determine whether an email address appears in known breach datasets. An email match does not prove someone accessed the account, and no match cannot guarantee that an address or password has never been exposed. Never submit your current password to a site just to check it.
Why password hashes can still matter
Hashing helps limit damage when a password database is stolen, but security depends on the hashing method and on password strength. Bcrypt includes a configurable work factor, which makes each guess computationally more expensive. Salting means each password hash is combined with a distinct random value, helping prevent attackers from using one precomputed table to crack many accounts at once.
Neither measure makes weak passwords invulnerable. A common password can still be guessed, and a password reused on another breached service can be exploited without cracking the Dropbox hash at all. This is why unique passwords and two-step verification remain useful even when a service reports that stored passwords were hashed.
Frequently Asked Questions
Was Dropbox hacked in 2016?
Yes. Dropbox disclosed a security incident in 2016 tied to credentials stolen in 2012. The widely reported dataset contained about 68 million email addresses and hashed passwords.
Were Dropbox users’ files leaked?
The commonly documented breach involved account information, especially email addresses and password hashes. Reports do not establish that all users’ stored files were published as part of this incident.
Were the exposed Dropbox passwords readable?
Dropbox said they were hashed and salted, rather than stored as plain text. Hashing makes recovery harder, but weak passwords may still be guessed, and reused passwords can put other accounts at risk.
How can I check whether my email was in the breach?
You can check a reputable breach-notification service that reports known incidents. Treat a match as a reason to secure accounts, not proof that someone accessed them; do not provide your current password to a checker.
Should I change my Dropbox password now?
If it is old, reused, or potentially exposed, change it to a unique password. Also update that password anywhere else it was used, enable two-step verification, and review account sessions.
Does the 68-million figure mean 68 million accounts were taken over?
No. It describes the approximate size of the credential dataset reported online, not a confirmed count of accounts successfully accessed or misused.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.