Dropbox

Disclosed Jul 31, 201268,648,009 affectedConfirmed

Stolen employee password leads to Dropbox user email theft; 68M credentials later leak

Dropbox said usernames and passwords stolen from other sites were used to sign in to some accounts, including an employee account holding a project document with user emails. In 2016 a dump of 68.6 million Dropbox credentials from 2012 surfaced.

What is known

People affected	68,648,009 (as reported by the organization)
Disclosed	Jul 31, 2012
Happened	Jul 1, 2012
Attack	Credential stuffing
Data exposed	EmailsPasswords
Sector	Tech · US
Status	Confirmed
Check your email	Have I Been Pwned

Sources

Aggregatorhaveibeenpwned.com

Have I Been Pwned: Dropbox

The organizationblog.dropbox.com

Security update and new features

Notices filed

TotalJul 31, 2012

Research68,648,009 people

Accounts in the dataAug 31, 2016

Have I Been Pwned68,648,009 people

Other breaches at Dropbox

Lenovo ID verification flaw let attacker access about 5,000 Dropbox accountsVendor breach, data exposed not stated.Vendor breach5,000 affectedTechUSUnverifiedSep 2 Material cybersecurity incident reported to the SEC (8-K Item 1.05)Material cybersecurity incident reported to the SEC (8-K Item 1.05)TechUSMay 1, 2024 Phishing attack lets hacker steal 130 Dropbox GitHub repositoriesPhishing exposed source code and API keys.PhishingTechUSUnverifiedNov 1, 2022

History of this record

source_type2026-09-25

aggregator to companyby seedSource

source_url2026-09-25

https://haveibeenpwned.com/Breach/Dropbox to https://blog.dropbox.com/topics/company/security-update-new-featuresby seedSource

status2026-09-25

disclosed to confirmedby seedSource

verified_by2026-09-25

empty to researchby seedSource

verified2026-09-25

0 to 1by seedSource

country2026-09-25

empty to USby seedSource

attack2026-09-25

unknown to credential-stuffingby seedSource

records_basis2026-09-25

hibp to organizationby seedSource

disclosed2026-09-25

2016-08-31 to 2012-07-31by seedSource

summary2026-09-25

In mid-2012, Dropbox suffered a data breach which exposed the stored credentials of tens of millions of their customers. In August 2016, they forced password resets for customers they believed may be at risk . A large volume of data totalli to Dropbox said usernames and passwords stolen from other sites were used to sign in to some accounts, including an employee account holding a project document with user emails. In 2016 a dump of 68.6 million Dropbox credentials from 2012 surfby seedSource

title2026-09-25

empty to Stolen employee password leads to Dropbox user email theft; 68M credentials later leakby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Have I Been Pwned), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Dropbox