Dropbox Not Hacked, Unrelated Services Were

Dropbox denied they suffered an attack, however login credentials leaked by someone on Pastebin are those of Dropbox users.

The leaker released the first batch of credentials and then asked interested users to donate bitcoins in order for the leaks to continue. In the following hours, the attacker continued to leak batches even though there was only one donation.

RELATED STORIES
Bash Attack on NAS Systems
Shellshock Attacks Raging
Honeypot Finds Shellshock Attacks
Shellshock: Cisco Lists 31 Vulnerable Products

Simultaneously, more batches released and another bitcoin address provided for donations. No donations have gone out.

Dropbox statement, saying: “Your stuff is safe. The usernames and passwords referenced in these articles were stolen from unrelated services, not Dropbox. Attackers then used these stolen credentials to try to log in to sites across the Internet, including Dropbox,” Anton Mityagin from the Dropbox security department said.

“Attacks like these are one of the reasons why we strongly encourage users not to reuse passwords across services. For an added layer of security, we always recommend enabling 2 step verification on your account,” he pointed out, adding the company has measures in place to detect suspicious login activity and that they automatically reset passwords when it happens.

Mityagin also said they checked the lists of usernames and passwords posted online and they are not a part of Dropbox accounts.