Dropbox in password reuse security breach

Dropbox has admitted that a number of customers have been spammed following a breach of its infrastructure that led to a number of accounts being compromised.

The cloud storage provider said that it was made aware of the breach when account holders reported receiving unwanted messages in email accounts used only for Dropbox communications.

The company said in a blog post that it had taken action to investigate claims.

"A couple weeks ago, we started getting emails from some users about spam they were receiving at email addresses used only for Dropbox. We've been working hard to get to the bottom of this, and want to give you an update," said Aditya Agarwal, vice president of Engineering at Dropbox.

"Our investigation found that usernames and passwords recently stolen from other websites were used to sign in to a small number of Dropbox accounts. We've contacted these users and have helped them protect their accounts."

The company confirmed that several other accounts were also compromised when an employee's Dropbox account also got hacked.

"A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses," said the company.

"We believe this improper access is what led to the spam."

Dropbox apologised for the breach and said it would now put additional controls in place to help make sure it doesn't happen again.

The company has now reset affected customers' passwords and will be implementing two-factor authentication including temporary codes sent to mobile phones when signing in.

It also plans to introduce automated mechanisms to help identify suspicious activity. Dropbox said it would also continue to add more of these over time.

Neil Cook, chief technology officer of security company Cloudmark said that the breach was "unsophisticated".

"The offending messages were hitting a handful of spammy fingerprints at once," he said. "If this were an exam, the spammer would receive an ungraded' mark for lack of message complexity or originality."

Cook added that recent data from Cloudmark's Global Threat Network found that there were 264 different domains in use by this spammer.