Dropbox Sign production breach via a compromised service account
On April 24, 2024 Dropbox detected unauthorized access to the Dropbox Sign (formerly HelloSign) production environment. The attacker compromised a service account in Sign's automated system configuration tool, which had privileges to act in production, and reached the customer database: emails, usernames, phone numbers, hashed passwords, and for some users API keys, OAuth tokens and MFA data. Dropbox disclosed in an 8-K on May 1, 2024, and rotated API keys and OAuth tokens.
- Victim
- Dropbox (Dropbox Sign)
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Apr 2024
- First disclosed
- May 1, 2024
- Actor
- Unattributed
- Initial access
- Stolen credentials
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
An automation service account with broad production privileges is a human admin without the human controls. Least-privilege scoping and monitoring of service account use would have shrunk what one compromise exposed.
Sources
- Dropbox Form 8-K (Item 1.05), US SEC, May 1, 2024
- A recent security incident involving Dropbox Sign, Dropbox, May 1, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Cloudflare Atlassian intrusion with credentials left unrotated after the Okta breach 2024 · Stolen credentials
- Sumo Logic AWS account accessed with a compromised credential 2023 · Stolen credentials
- GitHub repositories cloned with a compromised machine-account token 2023 · Stolen credentials
- Ronin bridge theft via compromised validator keys 2022 · Stolen credentials
Cite this record
SWI Community Team. (2026). Dropbox Sign production breach via a compromised service account. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-dropbox-sign-service-account-compromise/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.