Dropbox requires users to change ‘old’ passwords

Dropbox has sent an email to its users telling some to change their passwords. This is necessary in case the password has not been changed since 2012. The measure has to do with a hack from years ago.

Anyone who has not changed their Dropbox password since mid-2012 will receive the message to choose a different password the next time they log in. The cloud storage company is doing this as a precaution, according to a blog post; it is not certain that passwords or other user data were actually stolen.

In 2012, there was a hack that looted user accounts on other websites, which also tried to log in to Dropbox accounts. Access was given to an account of an employee, which gave the hackers a list of email addresses of users. They then complained about spam, after which an investigation was launched.

It now appears that the hackers may have also gained access to usernames and encrypted passwords at the time of that incident. Because Dropbox cannot guarantee that the accounts are secure, all passwords that have not been changed since the hacking incident must still be changed.