Dropbox data breach (2012): what happened and what to do
2 min read · Updated October 15, 2026
Dropbox confirmed in 2016 that credentials from a 2012 breach had surfaced, covering roughly 68 million accounts. The data included email addresses and hashed passwords. Dropbox prompted password resets. If you used Dropbox then, change reused passwords and enable two-factor authentication.
What happened
In 2012 attackers obtained user data from Dropbox. The scale was not widely known until 2016, when the data surfaced online. The company then asked affected users to reset their passwords.
What was exposed
- ✓Email addresses.
- ✓Hashed passwords, with stronger protection used for many of them.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
Why old breaches still matter
Even when hashing is strong, any reused or weak password may be at risk. Cloud storage accounts often contain sensitive documents, so securing them is worthwhile.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Are my files at risk?+
The reported exposure concerned credentials, not stored files. A reused password could still let attackers sign in.
Does Dropbox support 2FA?+
Yes, and enabling it is strongly recommended.
How can I see if my email was included?+
Run a breach check on the address you used.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.