Dropbox Plan
Professional
Are you a Team Member or Admin?
No
Do you have access to the email linked to the account?
Yes
Are there any devices connected to your Dropbox account?
Phone, tablet, work laptop
Question or Issue
A few days ago, My Dropbox account was hacked by an individual calling themselves Samuel Shimb (see screenshot below).
They managed to get access to my account even with 2FA enabled (via SMS)!
I want to make people aware of this and the fact that, when I raised this to Dropbox's chat and Support people, they downplayed it and said they's pass it along to their colleagues. Even when I mentioned in my communication with them that I had 2FA enabled, but did not receive any 2FA OTP, in their responses, they still went ahead to say that I must enable 2FA.
I have been asking for escalations without any assistance on this matter.
I am a paying Dropbox Professional customer, and I want to know how someone accessed my account outside of the normal authentication flow. Even if the hacker managed to obtain my Dropbox password (which I was not using anywhere else by the way), I want to know how they bypassed the 2FA. There were no indications in my GMail inbox of someone trying to reset my Dropbox password (so the hacker did not gain access to my email account first). I was able to login normally using my Dropbox account even after the attack.
This has resulted in sensitive information being exposed to an attacker whose intentions I do not know, including work files. However, Dropbox staff have been downplaying this isse. Maybe because this could be a vulnerability on the side of Dropbox and they won't admit that.
