This means that attackers will be having a difficult time getting at the passwords underneath – if they are not predictable and short. The publication obtained the full set of compromised credentials, and found that some 32 million passwords have been secured with bcrypt, and the rest with SHA-1 + salt. The number has finally been revealed by Motherboard, and the legitimacy of the data confirmed by an unnamed senior Dropbox employee. He added that they don’t believe that any accounts have been improperly accessed, but again did not share say just how many user credentials have been stolen. As part of these ongoing efforts, we learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe was obtained in 2012,” Patrick Heim, Head of Trust & Security for Dropbox, explained in a blog post.

“Our security teams are always watching out for new threats to our users. In any case, last week Dropbox announced it will be forcing a password update on users who signed up for the service prior to mid-2012 and haven’t changed their password since then. A breach disclosed by Dropbox in 2012 has resulted in the theft of usernames and hashed and salted passwords of over 60 million users.Īt the time, the company did not give the impression that the breach was so extensive – either their investigation did not discover the whole extent of it, or the company chose not to disclose it.

Dropbox login security