Incident
incident:dropbox_breach
Intrusion into Dropbox’s corporate network followed by theft of user details containing email addresses, usernames, and salted password hashes.
Intrusion into Dropbox’s corporate network followed by theft of user details containing email addresses, usernames, and salted password hashes.
“Dropbox looked through their logs and confirmed that yeah, those IPs did connect in”
“the hacker stole at least twenty million user details”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | Dropbox | Explicit | 86 |
| outgoing | INITIAL_ACCESS_VIA | credential reuse | Uncertain | 86 |
| outgoing | INVOLVES | credential reuse | Explicit | 86 |
| outgoing | ASSOCIATED_WITH | Yevgeniy Nikulin | Attributed | 86 |
| incoming | RELATED_TO | LinkedIn data breach | Explicit | 86 |
Dropbox breach COMPROMISES Dropbox
Dropbox confirmed unauthorized access to its corporate network and later determined that user details had been stolen.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“Once Dropbox did confirm there was unauthorized access into the network”
Dropbox breach INITIAL_ACCESS_VIA credential reuse
The hacker appears to have entered Dropbox using a reused password belonging to a Dropbox engineer; Jack is uncertain whether the same password was used at Dropbox.
Uncertain Confidence 89% · Jack Rhysider EP 86 Details
“But did this engineer use the same password where he worked too, at Dropbox? I don’t know for sure but the hacker was able to login as the engineer at Dropbox.”
Dropbox breach INVOLVES credential reuse
The Dropbox engineer acknowledged reusing the same password across several personal accounts, enabling the hacker to access additional accounts.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“His Twitter, Facebook, LinkedIn, and Google accounts all had the same password”
LinkedIn data breach RELATED_TO Dropbox breach
The FBI linked the LinkedIn and Dropbox incidents through matching IP addresses, user agents, and related account activity.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“Someone had breached LinkedIn, Dropbox, and Formspring all from the same IPs and same user agents with a trail connecting it all”
Dropbox breach ASSOCIATED_WITH Yevgeniy Nikulin
Kislitsin told the FBI that Yevgeniy Nikulin was the person who broke into Dropbox and still had access to it; this is an attributed account, not an independently stated fact in the episode.
Attributed Confidence 94% · Jack Rhysider EP 86 Details
“he told them that Yevgeniy Nikulin was the person who broke into Dropbox and still had access to it”