In a previous post, we reported that Dropbox emailed its users, demanding that they change their passwords, when it discovered a data leak from a breach that occurred in 2012.
According to new information, accounts from 68 million users were leaked.
Dropbox admitted to the breach in 2012, when the incident occurred, but never revealed details about how it happened or how many users were affected.
According to an analysis published by LeakedSource, the data stolen in 2012 includes details from 68,680,741 users in the format of “email:.password_hash”
The passwords have been hashed with two different algorithms. 31,865,280 passwords have been encrypted with bcrypt, and the remaining 36,815,461, with SHA1.
“It appears that SHA1 hashes are not directly crackable,” LeakedSource reports. According to a LeakedSource spokesperson, Dropbox uses “some unknown salt” to improve the complexity of the password hash.
Dropbox data does not appear to be circulating on Dark Web markets yet and we probably won't see it circulating as brute-force practices to crack passwords probably won't work due to the strong encryption.
“For the most part, the database is useless unless someone uses emails from Dropbox users to send spam,” LeakedSource reports.
