Hackers compromise Dropbox, steal 130 code repositories

Dropbox has confirmed a data leak that gave attackers access to one of the company’s GitHub accounts using stolen employee data.

Dropbox is a file hosting service that provides cloud storage, file synchronization, personal cloud and client software.

“To date, our investigation has found that the code accessed by this threat actor contained some credentials—primarily, API keys—used by Dropbox developers. The code and the surrounding data also included a few thousand names and email addresses belonging to Dropbox employees, current and past customers, sales leads, and vendors (for context, Dropbox has more than 700 million registered users),” said Dropbox.

The breach was made possible after attackers targeted several Dropbox employees in a phishing attack. The phishing email pretended to be the CircleCI continuous integration and delivery platform, redirecting employees to a phishing landing page, where they were asked to enter their GitHub username and password. The employees on the same phishing page, were asked to “use their hardware authentication key to pass a One Time Password (OTP).”

After a successful phishing attack and the theft of credentials, the hackers gained access to one of Dropbox’s GitHub accounts and stole 130 of their code repositories.

Dropbox said the attackers did not have access to customer accounts, passwords or payment information, and the main apps, information and infrastructure were not affected by the breach.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web