Dropbox Sign: an automated account opened the customer database

What was reported

Dropbox Sign’s completed investigation described compromise of a service account through an automated configuration tool. The attacker accessed customer data, including authentication information such as API keys and OAuth tokens. Dropbox found no evidence of unauthorized access to documents, agreements or payment information, and said other Dropbox products were not affected.

Read the report from Dropbox Sign

Our perspective

Our reading: Non-human accounts deserve the same careful scope as people. AI connections should have a defined task boundary and revocable credentials rather than broadly inheriting production privileges.

Limits of this connection

The account-data exposure should not be described as theft of signed documents. This incident does not demonstrate that Vivendur could secure the underlying service account.