Dropbox data breach (2012)

In mid-2012, an attacker stole a database holding the credentials of roughly 68 million Dropbox users. The theft stayed quiet for four years until the file surfaced for sale on the dark web in 2016.

What happened

The intrusion traces back to a single reused password. A Dropbox employee had used the same password on LinkedIn — itself breached in 2012 — and on their corporate Dropbox account. Using those harvested LinkedIn credentials, the attacker logged into the employee's account and reached a project document that contained a set of user email addresses. From there they obtained a database of user records.

At the time, Dropbox disclosed only that an employee account had been accessed and that user email addresses were involved, prompting a wave of spam. The full scope — a dump of 68,648,009 accounts with hashed passwords — only became clear in 2016.

How the credentials were protected

Unlike the Adobe disaster of the prior year, Dropbox had hashed and salted its passwords. The leaked file split roughly in half: older accounts used SHA-1, while newer ones used bcrypt, a deliberately slow algorithm resistant to mass cracking. The bcrypt half was effectively safe; the SHA-1 half was weaker but still salted, slowing recovery considerably.

Impact

• About 68 million account records (email addresses and salted password hashes) were exposed and ultimately traded online.
• In August 2016, Dropbox proactively forced password resets for all accounts that predated mid-2012 and hadn't updated credentials, before the dump was widely circulated.
• The breach is attributed to Yevgeniy Nikulin, a Russian national arrested in Prague in 2016, extradited to the U.S., and sentenced in 2020 to more than seven years for the Dropbox, LinkedIn and Formspring intrusions.

Why it matters

Dropbox is the definitive case study in credential-reuse blast radius: a breach at one company (LinkedIn) cascaded into a breach at another because an employee reused a password across personal and corporate systems. It demonstrates both a failure — no enforced separation or MFA on a sensitive internal account in 2012 — and a relative success: because Dropbox salted and partly bcrypt-hashed its passwords, the eventual dump was far less damaging than it could have been. The incident accelerated industry adoption of mandatory MFA for employees, bcrypt/scrypt password storage, and proactive resets ahead of public credential leaks.