I received an email from <no-reply@dropbox-notifications.com> that my account had been breached. Is this a phishing attack?
Almost certainly - just because the email says its from that doesnt mean it is.
What url (mouse over it) is it asking you to click on?
You can also forward the email to abuse@dropbox.com
