Instead, the hacker was able to access a “few thousand names and email addresses belonging to Dropbox employees, current and past customers, sales leads and vendors”. In a statement, Dropbox assured users that the threat actor did not gain access to the contents of any Dropbox accounts, passwords or payment information. The hacker was able to access and copy the code for 130 of Dropbox’s code repositories, although this did not contain any code for its core apps or infrastructure. Through the attack, the hacker gained access to some of the code Dropbox stores using the platform, including API keys used by its developers.ĭropbox was alerted to the breach by GitHub after suspicious activity was noticed on its account.

The attack, which took place on October 14, saw a malicious actor pose as code integration and delivery platform CircleCI in order to harvest login credentials and authentication codes from employees and gain access to Dropbox’s account on code repository site GitHub, as CircleCI login information can be used to access Github.

Cloud storage company Dropbox has suffered a data breach after its employees were targeted by a phishing attack.

Dropbox cloud security