“This configuration tool enabled the threat actor to execute applications and automated services with elevated privileges, allowing the attacker to access the customer database.”
Attackers got into a backend configuration tool for Dropbox Sign and walked out with API keys, OAuth tokens, MFA keys and hashed passwords. People who only signed a document and never made an account lost their names and emails too. Dropbox says no documents were touched. The thieves now hold the MFA secrets, and customers have to rebuild their authenticator setups to undo it.