Dropbox's 2012 breach exposed 68M accounts — disclosed as 'a small number'

In 2012, hackers accessed Dropbox's systems and stole approximately 68 million user credentials — email addresses and hashed passwords. Dropbox disclosed a limited breach at the time, stating that a 'small number' of accounts had been compromised.

In August 2016, the full 68 million credentials appeared on a data-sharing site. Dropbox confirmed the data was authentic and acknowledged that the 2012 breach had been far larger than initially disclosed. The company forced password resets for all affected users.

The case was similar to the LinkedIn breach: a partial disclosure followed by the full truth emerging years later. Dropbox was criticized for not disclosing the full scope in 2012. The case illustrated how the pattern of 'disclose minimally, hope it goes away' is a recurring failure in the tech industry, and how the full truth always surfaces — usually at the worst possible time.