Dropbox Data Breach: What Was Exposed and What to Do
The Dropbox breach happened in 2012 but only came to light in 2016. The lesson is old, yet it still matters for anyone who has reused a password.
By Siddharth ShankarUpdated October 20, 2026In July 2012, attackers took 68.6 million Dropbox email addresses along with password hashes. The data surfaced in 2016, Dropbox forced password resets, and it was added to Have I Been Pwned on August 31, 2016. About half of the passwords were salted SHA1 hashes and half were salted bcrypt. If you reused your old Dropbox password anywhere, change it there. Otherwise, use the check below and move on.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Dropbox is one of the most widely used file storage services, so a breach there reached a lot of people. This one is also a good example of how a breach can sit quietly for years before it becomes public.
What happened
According to Have I Been Pwned, Dropbox suffered a data breach in mid-2012. The stolen data did not become widely known until August 2016, when it appeared for sale. Dropbox then forced password resets for accounts that had not changed their password since mid-2012, and the data was added to Have I Been Pwned on August 31, 2016.
What was exposed
The breach contained 68.6 million unique email addresses. Each came with a password hash rather than the password itself:
- About half of the passwords were hashed with SHA1 and salted.
- The other half were hashed with bcrypt, a slower and stronger method.
A salted hash is not a readable password, but a weak or common password can still be cracked by guessing. Bcrypt makes that guessing far slower than SHA1.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
Why an old breach still matters
The key risk is reuse. If you used your 2012 Dropbox password on other sites and never changed it, an attacker who cracked the hash could try it on your email or bank. This is called credential stuffing. Dropbox’s forced resets removed the risk for the Dropbox account itself, but not for other services that shared the password.
Most people have changed passwords since 2012. Still, an email address listed in a breach is a long-lived signal: it shows the address is real and in use, which helps spammers and phishers. See should you worry about an old data breach.
What to do
1Check whether you are listed
Search your email address in our free email check to see if it appears in this or other breaches.
2Change any reused password
If you ever used the same password as your old Dropbox one, change it on every other site now.
3Use a password manager
A manager gives every account a unique password, so one breach does not spread. Keep it on a trusted device.
4Turn on two-step verification
Add it to Dropbox, your email and your bank. An authenticator app is stronger than text messages.
5Watch for phishing
Be wary of emails claiming to be Dropbox that ask you to log in through a link. Go to the site directly.
How hashes protect and fail
A hash is a one-way scramble of a password, so the company never needs to store the real thing. Stronger hashing methods such as bcrypt are slow to guess at scale, while older methods such as SHA1 are quick. That is why the mix of both in this breach mattered: weak passwords protected by the faster method were the most at risk.
Take a moment to tidy your accounts
An old breach is a good prompt to review your accounts. Remove old files from cloud storage you no longer use, close accounts you do not need and update the recovery email and phone number on the ones you keep.
Related reading
To understand what hashed passwords mean, see what each type of breached data means. For the first steps after any breach, read your email was in a data breach: what to do next.
Sources
- Have I Been Pwned: Dropbox breach (July 2012, 68.6 million emails, SHA1 and bcrypt hashes, 2016 resets, added August 31, 2016)
Frequently asked questions
When did the Dropbox breach happen?
In mid-2012. The data surfaced in 2016 and was added to Have I Been Pwned on August 31, 2016.
How many accounts were affected?
Have I Been Pwned lists 68.6 million unique email addresses.
Were passwords stolen in plain text?
No. They were salted hashes, about half SHA1 and half bcrypt.
Do I need to change my Dropbox password now?
Dropbox forced resets in 2016. Change any other account that shared your old Dropbox password.
How can I check if my email was in the breach?
Use a breach check tool such as our free email check or Have I Been Pwned.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.