You might see that the Dropbox Community team have been busy working on some major updates to the Community itself! So, here is some info on what’s changed, what’s staying the same and what you can expect from the Dropbox Community overall.
Forum Discussion
Employee Compromised Account
I have an employee here that signed up for a free DropBox account with their work email. The account has been compromised and the MFA phone number has been changed, so even though I can get a passwor...
Nancy
Dropbox Staff
Dropbox StaffI’m sorry to hear about the situation, jchamp_shlc.
Unfortunately, it’s only possible to delete a Dropbox account, after logging in to it, and our support team can’t do it on their end either, due to security reasons.
However, can you please check with your employee if they have the emergency codes they received upon setting up two-step verification? If they do, they can use them to access the account instead, to change the 2FA phone number, email and password, or delete it, if they wish to.
Other than that, they can check if they have a backup phone number that may still work, or check their linked devices (for more info, please check the attached link).
Let me know, if that helps.
We are experiencing the same issue. Our staff members mailbox was temporarily compromised, during which the attacker logged in to their Dropbox and set up a 2FA Authenticator App.
We reset the password but cannot actually log in without the 2FA or recover code - of which we have neither. The attackers session is still active, so they're sending out fraudulent emails with malicious payloads.
If we could simply terminate all active sessions this would fix the issue, but we can only do that by logging in (chicken & egg situation). We logged a ticket with Dropbox asking they do this for us, but they have not responded.
This is a disaster, and SHAME on Dropbox for allowing this kind of situation to occur. At the very least terminate all the current sessions when the password is reset! Crazy.
If ANYONE at Dropbox cares, because our clients certainly do, the ticket number is: 22934270
- Helen DBX
Hey there,
Helen from Dropbox here.
A security specialist has just responded to your ticket. Please have a look and we will take care of that for you.
Best regards,
Helen
The Dropbox Team
https://www.dropbox.com/help
