Dropbox Sign

Threat actor accesses Dropbox Sign production environment and all user data

Dropbox said it became aware on April 24, 2024 of unauthorized access to the Dropbox Sign (formerly HelloSign) production environment. The actor accessed emails, usernames and account settings for all Dropbox Sign users and, for subsets of users, phone numbers, hashed passwords and authentication information such as API keys and OAuth tokens.