Dropbox hurriedly warned its users last week to change their passwords if their accounts dated back prior to mid-2012. We now know why: the cloud-based storage service suffered a data breach that's said to have affected more than 68 million accounts compromised during a hack that took place roughly four years ago.

The company had previously admitted that it was hit by a hack attack, but it's only now that the scale of the operation has seemingly come to light.

Tech site Motherboard reported—citing "sources in the database trading community"—that it had obtained four files, totalling 5GB in size, which apparently contained e-mail addresses and hashed passwords for 68,680,741 Dropbox users.

A senior Dropbox employee was quoted as saying, unofficially, that the data was legit.

The hack was later confirmed by Australian security expert Troy Hunt—the man behind haveIbeenpwned.com—who claimed to have seen the data. After performing his own tests, he said: "There is no doubt whatsoever that the data breach contains legitimate Dropbox passwords."

Dropbox's security boss Patrick Heim later insisted that it was "not a new security incident," claiming that "there is no indication that Dropbox user accounts have been improperly accessed." He said:

Our analysis confirms that the credentials are user e-mail addresses with hashed and salted passwords that were obtained prior to mid-2012. We can confirm that the scope of the password reset we completed last week did protect all impacted users. Even if these passwords are cracked, the password reset means they can’t be used to access Dropbox accounts. The reset only affects users who signed up for Dropbox prior to mid-2012 and hadn’t changed their password since. While Dropbox accounts are protected, affected users who may have reused their password on other sites should take steps to protect themselves on those sites. The best way to do this is by updating these passwords, making them strong and unique, and enabling two-step verification. Individuals who received a notification from Dropbox should also be alert to spam or phishing.

But the company hasn't publicly confirmed or denied that more than 68 million accounts had been compromised in the attack.

Dropbox "seems to have handled this really well," Hunt added, noting that it had e-mailed everyone who was apparently affected, forcing password resets in a timely manner, and using a strong hashing algorithm to protect the information. "Frankly," he said, "all but the worst possible password choices are going to remain secure even with the breach now out in the public."

Update

In response to Ars' question about the number of accounts affected by the hack, a Dropbox spokesperson told us after publication of this story: “We can confirm that based on our intelligence number we have seen is in the 60+ mil range.”

Meanwhile, a separate data breach was revealed on Tuesday by OneLogin, a cloud-based password security app.

The San Francisco-based identity management firm's security head Alvaro Hoyos admitted that "an unauthorised user gained access to one of our standalone systems, which we use for log storage and analytics."

The compromised service, Secure Notes, allows end users to store privileged information, possibly including admin passwords, license keys, and firewall passwords.

OneLogin, which is used by millions of customers and has previously been trumpeted by the likes of AWS and Netflix, said that a single rogue user gained access to the service for at least a month by compromising a staff account—and that a bug in its systems might have allowed them to see the notes "prior to being encrypted."

The company has warned customers—who might have updated their notes at any point between June 2 and August 25 this year—that their data could be at risk.

Hoyos claimed that the breach would only affect "a small subset of our customers, who we are working with directly on this issue."

The cleartext logging bug has been fixed, we're told, while access to the system has been locked down and passwords reset so as OneLogin can continue to investigate the breach.

"Again," wrote Hoyos, "our most sincere apologies. We are making every effort to prevent any similar occurrence in the future."