DropBox has announced a breach in its DropBox Sign eSignature platform, formerly known as HelloSign. The breach, uncovered on April 24, has left customer data vulnerable, including authentication tokens, MFA keys, hashed passwords, and personal information.
The breach was first detected on April 24, prompting DropBox to launch a thorough investigation into the matter. Through this investigation, it was revealed that threat actors had gained unauthorised access to a crucial configuration tool within the backend services of the DropBox Sign platform. This access granted them added privileges, allowing them to penetrate the customer database.
The compromised data encompasses a bulk of sensitive information, ranging from customer emails, usernames, and phone numbers to hashed passwords and account settings. Even individuals who had not registered accounts with DropBox Sign had their email addresses and names exposed, magnifying the scope of the breach.
Some Measures To Consider
DropBox readily took action to restore the collateral damage. All user passwords were reset, and all sessions to DropBox Sign were logged out as a precautionary measure. Furthermore, the company imposed restrictions on the usage of API keys until they could be rotated by the respective customers. Additionally, users who employ Multi-Factor Authentication (MFA) are advised to delete and reconfigure their settings with new keys obtained from the official website.
No Access to Docum
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.