Dropbox has denied claims that hackers broke into its systems and stole 7m usernames and passwords, which they are now threatening to leak online.



Several hundred usernames and passwords were posted by the hackers on the text-sharing site Pastebin, claiming them to be a small sample of the 7m logins taken directly from the Dropbox servers.

The hackers are requesting Bitcoin “donations” to release the rest of the alleged Dropbox user data.

“Your stuff is safe. The usernames and passwords referenced in these articles were stolen from unrelated services, not Dropbox,” Anton Mityagin who is part of Dropbox’s security team wrote in a blogpost. “Attackers then used these stolen credentials to try to log in to sites across the internet, including Dropbox. We have measures in place to detect suspicious login activity and we automatically reset passwords when it happens.”

Mityagin also said that testing of subsequent lists of usernames and passwords found them not to be connected with Dropbox accounts.

‘Not the first time we’ve seen this –it’s just another way to monetise stolen data’

Password reuse is blamed for some of the leaked details being seemingly coincidentally valid for Dropbox. It is unknown how many of them worked, but Dropbox has since revoked any that it found to be valid.

“Stolen credentials can be abused to login to select accounts, but then tried speculatively on any number of other accounts and services,” Rik Ferguson, vice president of research at security firm Trend Micro, explained to the Guardian. “Because of password reuse, which unfortunately is still a common phenomenon, there will always be a percentage that could be valid on unrelated services.”

“It seems obvious that these credentials have been acquired from previous leaks and are being abused in more than one inventive way,” Ferguson said. “It’s not the first time we’ve seen it, and it’s just another way to monetise stolen data – there is no honour among thieves and this is a very adequate demonstration of that.”

‘In some cases the data doesn’t exist, others its not valid’

Other password leaks have been used in a similar manner, reused and rereleased by hackers hoping to sell the data on. The Russian hacking scare in August in which security researchers Hold Security claimed hackers had 1.2bn usernames and passwords, was questioned by others as a similar situation – a collation of previous credential leaks combined with other data.

“There have been cases where people have looked for bitcoin donations where the data does not exist at all, in others the data is not for the services that it’s being advertised for and doesn’t come from the sources that it’s advertised as coming from,” explained Ferguson.

Two-factor authentication is the key

Both Dropbox and Ferguson urge users to adopt two-factor authentication – where another device such as a number generator app on a smartphone or USB key is used as a secondary login factor, without which the password and username do not work.

“Two-factor authentication might add an extra, slightly inconvenient step in your use of apps and services, but if someone tries to log into your service from an unknown device or a suspicious location, two-factor authentication will stop that happening as long as they do not have access to your other device, whatever that may be,” said Ferguson. “It’s available for Dropbox, Google, Facebook – most of the major services. Turn it on.”

Users who think they could be victims of the password leak are urged to change their password. Dropbox said that it has revoked any passwords that it thinks has been compromised, requiring users to reset those passwords.

“Clifford Stoll’s classic quote ‘Your password is like your toothbrush – never share it with anyone and change it every six months’ is just as valid today,” quipped Ferguson.

• How to protect your personal data from the next hack attack

• What to do if your email gets hacked - and how to prevent it

• Apple tightens security with two-factor authentication after alleged iCloud hack