We are aware of the issue with the badge emails resending to everyone, we apologise for the inconvenience - learn more here.

Forum Discussion

gebruikersnaam's avatar
gebruikersnaam
Explorer | Level 4
6 years ago

Hackers abusing Dropbox to access Gmail?!!!

Google Chrome is up-to-date Versie 75.0.3770.100 (Officiële build) (32-bits) I sent the Chrome team this 2 days ago and I also contacted API Support team... Copy-paste: Somehow the virus cont...
Account Settings
Create or delete account
Security
Daphne's avatar
Daphne
Icon for Dropbox Staff rankDropbox Staff
6 years ago
Hey there gebruikersnaam, I’m sorry to hear you experienced this!
 
Just to ensure that I understand the situation clearly, can you please clarify for me the role of Dropbox in this for me. From what I understood, Dropbox accounts were created with your Gmail email addresses, is that right?
 
When creating a Dropbox account, you can create it under any email address (so be careful of typos). However, to be able to use the features of Dropbox you will need access to the email address the account was created under to verify the account. Were the notifications you received about getting started and verifying the email address?
 
In terms of what Gmail info can be accessed through a Dropbox account, without verifying the account you wouldn’t be able to access anything. If the account had been verified and the Gmail account connected through the connected apps (which you would see from the account settings), then through Dropbox, contacts and calendars could be accessed. 
 
Essentially, it wouldn’t be possible to access your Gmail account by creating a Dropbox account under that email address.
 
I hope this hits the mark but please let me know if there is anything I’ve misunderstood or you would like some further clarification on. I’d be more than happy to assist you with this.
 
Thanks!
    • gebruikersnaam's avatar
      gebruikersnaam
      Explorer | Level 4
      6 years ago

      Q: "Were the notifications you received about getting started and verifying the email address?"

      No. No sign-up emails were received, just the above ones. A password reset for the compromised email addresses for which I got the Google warnings, did not get a password reset email from Dropbox. Google Account activity clearly shows activity from a browser session in Sweden, on ALL affected accounts.

       

       

      Dropbox connected to your account
      June 28, 2019 at 1:17 PM

       

      Dropbox was granted permission to connect to your Google Account
      Device:
       
      Windows
      Time:June 28, 1:17 PM
      Location:Sweden
      IP address:185.236.42.111
       
       
       
       
       

       

       
       
       
       
       
      Map data ©2019
       
       
      Approximate location (may include nearby towns)
      • Daphne's avatar
        Daphne
        Icon for Dropbox Staff rankDropbox Staff
        6 years ago
         
        Thanks for providing that info for me. At this point, it would be best to continue this discussion over on our Support channel due to the nature of the issue. Would you mind if I reached out to the email address associated with your Community profile?
         
        Let me know - Thanks!

About Settings and Preferences

The Dropbox Community is here to help if you have questions about your account settings and preferences. Learn and share advice with members.

Need more support

If you need more help you can view your support options (expected response time for an email or ticket is 24 hours), or contact us on X or Facebook.

For more info on available support options for your Dropbox plan, see this article.

If you found the answer to your question in this Community thread, please 'like' the post to say thanks and to let us know it was useful!