Popular cloud storage firm Dropbox has been hacked, with over 68m users\u2019 email addresses and passwords leaking on to the internet. <\/p>\n

The attack took place during 2012. At the time Dropbox reported a collection of user\u2019s email addresses had been stolen. It did not report that passwords had been stolen as well.<\/p>\n

The dump of passwords came to light when the database was picked up by security notification service Leakbase, which sent it to Motherboard.<\/p>\n

The independent security researcher and operator of the Have I been pwned? data leak database, Troy Hunt, verified the data discovering both his account details and that of his wife.<\/p>\n

Hunt said: \u201cThere is no doubt whatsoever that the data breach contains legitimate Dropbox passwords, you simply can\u2019t fabricate this sort of thing.\u201d<\/p>\n

Dropbox sent out notifications last week to all users who had not changed their passwords since 2012. The company had around 100m customers at the time, meaning the data dump represents over two-thirds of its user accounts. At the time Dropbox practiced good user data security practice, encrypting the passwords and appears to have been in the process of upgrading the encryption from the SHA1 standard to a more secure standard called bcrypt.<\/p>\n

Half the passwords were still encrypted with SHA1 at the time of the theft.<\/p>\n

\u201cThe bcrypt hashing algorithm protecting [the passwords] is very resilient to cracking and frankly, all but the worst possible password choices are going to remain secure even with the breach now out in the public,\u201d said Hunt. \u201cDefinitely still change your password if you\u2019re in any doubt whatsoever and make sure you enable Dropbox\u2019s two-step verification while you\u2019re there if it\u2019s not on already.\u201d<\/p>\n

The original breach appears to be the result of the reuse of a password a Dropbox employee had previously used on LinkedIn, the professional social network that suffered a breach that revealed the password and allowed the hackers to enter Dropbox\u2019s corporate network. From there they gained access to the user database with passwords that were encrypted and \u201csalted\u201d \u2013 the latter a practice of adding a random string of characters during encryption to make it even harder to decrypt.<\/p>\n

Dropbox reset a number of users\u2019 passwords at the time, but the company has not said precisely how many.<\/p>\n

The hack highlights the need for tight security, both at the user end \u2013 the use of strong passwords, two-step authentication and no reuse of passwords \u2013 and for the companies storing user data. Even with solid encryption practices for securing users\u2019 passwords, Dropbox fell foul of password reuse and entry into its company network.<\/p>\n

Leading security experts recommend the use of a password manager to secure the scores of unique and complex passwords needed to properly secure the various login details needed for daily life. But recent attacks on companies including browser maker Opera, which stores and syncs user passwords, and password manager OneLogin, have exposed the dangers of using the tool.<\/p>\n

Picking the right password manager is just as crucial and using one in the first place.<\/p>\n

A Dropbox spokesperson said: \u201cThere is no indication that Dropbox user accounts have been improperly accessed. Our analysis confirms that the credentials are user email addresses with hashed and salted passwords that were obtained prior to mid-2012. We can confirm that the scope of the password reset we completed last week did protect all impacted users.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

Popular cloud storage firm Dropbox has been hacked, with over 68m users\u2019 email addresses and passwords leaking on to the internet. The attack took place during 2012. At the time Dropbox reported a collection of user\u2019s email addresses had been stolen. It did not report that passwords had been stolen as well. The dump of […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"_links":{"self":[{"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/posts\/1723"}],"collection":[{"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/comments?post=1723"}],"version-history":[{"count":6,"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/posts\/1723\/revisions"}],"predecessor-version":[{"id":1736,"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/posts\/1723\/revisions\/1736"}],"wp:attachment":[{"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/media?parent=1723"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/categories?post=1723"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jms-securedata.co.uk\/wp-json\/wp\/v2\/tags?post=1723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}