Slashdot Mirror
Hackers Stole Account Details for Over 60 Million Dropbox Users
The Dropbox hack is more severe than we expected. Motherboard has the details: Hackers have stolen over 60 million account details for online cloud storage platform Dropbox. Although the accounts were stolen during a previously disclosed breach, and Dropbox says it has already forced password resets, it was not known how many users had been affected, and only now is the true extent of the hack coming to light. Motherboard obtained a selection of files containing email addresses and hashed passwords for the Dropbox users through sources in the database trading community. In all, the four files total in at around 5GB, and contain details on 68,680,741 accounts. The data is legitimate, according to a senior Dropbox employee. Security expert Troy Hunt has corroborated on Motherboard's claims, and has updated Have I Been Pwned website where you can go and see if you're among one of the victims.
Just FYI, although slashdot postings have never been extremely literate: Nobody corroborates ON something, you just corroborate something, i.e. I corroborated the claims about Dropbox. At least someone may have learned something on slashdot today.
Extremely legit, Troy Hunt goes to great lengths to ethically report breaches, hiding "sensitive" results (so you cant search someones email to see if they were an Maddison Ashley account holder, for example) as well as verifying a dataset is authentic (there are fake ones going around).
You should sign up to that site immediately, if you havent already. You get email notifications if a new breach includes your email address, which is worth it alone.
Is it possible that your email account was previously used by someone else, or that someone else signed up under your account?
Also not all the data necessarily pertains to log in account data. Perhaps your email address was a backup contact address, a friend's contact, referral, etc. There's lots of ways some basic information about you could be "compromised" with an data breach even if you never had an actual account.