Connection with Epson Printer just randomly stopped

The fact that Dropbox systematically responds that the problem is a third party problem without asking any questions or investigating is the sign of a voluntarily copout and that the problem is most likely from Dropbox.
DROPBOX get your act together and be professional.

It looks like there was a security issue with Dropbox sign. It looks like it happened at the end of the month (april) coincidentally. read below. Not sure if this has anything to do with what we are experiencing.

On April 24th, we became aware of unauthorized access to the Dropbox Sign (formerly HelloSign) production environment. Upon further investigation, we discovered that a threat actor had accessed Dropbox Sign customer information. We believe that this incident was isolated to Dropbox Sign infrastructure, and did not impact any other Dropbox products. We’re in the process of reaching out to all users impacted by this incident who need to take action, with step-by-step instructions on how to further protect their data. Our security team also reset users’ passwords, logged users out of any devices they had connected to Dropbox Sign, and is coordinating the rotation of all API keys and OAuth tokens. Please read on for additional details and an FAQ.

On April 24th, we became aware of unauthorized access to the Dropbox Sign (formerly HelloSign) production environment. Upon further investigation, we discovered that a threat actor had accessed data including Dropbox Sign customer information such as email addresses, usernames, phone numbers and hashed passwords, in addition to general account settings and certain authentication information such as API keys, OAuth tokens, and multi-factor authentication.

For those who received or signed a document through Dropbox Sign, but never created an account, email addresses and names were also exposed. Additionally, if you created a Dropbox Sign or HelloSign account, but did not set up a password with us (e.g. “Sign up with Google”), no password was stored or exposed. We’ve found no evidence of unauthorized access to the contents of customers’ accounts (i.e. their documents or agreements), or their payment information.

From a technical perspective, Dropbox Sign’s infrastructure is largely separate from other Dropbox services. That said, we thoroughly investigated this risk and believe that this incident was isolated to Dropbox Sign infrastructure, and did not impact any other Dropbox products.

What happened and our response

When we became aware of this issue, we launched an investigation with industry-leading forensic investigators to understand what happened and mitigate risks to our users.

Based on our investigation, a third party gained access to a Dropbox Sign automated system configuration tool. The actor compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database.

In response, our security team reset users’ passwords, logged users out of any devices they had connected to Dropbox Sign, and is coordinating the rotation of all API keys and OAuth tokens. We reported this event to data protection regulators and law enforcement.

Hello MMarchincin ,

Thank you for your input. This is most probably linked to our issue. I am not sure how you relate to the customer service from Dropbox as your messages indicates "WE". Please keep us posted if you have information on when this will get solved. We are in a mess for efficient work. Thank you.

Rich

@torero wrote:
I am not sure how you relate to the customer service from Dropbox as your messages indicates "WE".

They don't work for Dropbox. They are relaying the content of the notice that Dropbox posted about the incident.

https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign

tried all of that and no luck

I am not associated with dropbox but a user who is frustrated and ran across that in my search.

Josh L.20

Adding myself to the list.

I removed/re-added Dropbox (on both sides - EPSON and Dropbox).

I connected OneDrive to EPSON - which works.

And added Google Drive to EPSON - which works.

If this can't be sorted, I'm dropping my corporate and personal Dropbox accounts. This is bs.

If I may, what is BS is the way Dropbox is responding to the matter. In my case they keep saying not their problem. No question, no research. Dumping the problem on users.

Josh L.20

[deleted by user]

paddydingle

Same issues here, worked for years...

Josh L.20

Mark - the issue isn't with EPSON or Brother. It's with Dropbox, based on invalidated Oauth2 tokens (JWT, etc.).

tjbjmp

Jay,

I am having the same problem with my Epson RR-600W scanner, which also uses Epson Quick Connect. And I have tried the troubleshooting steps you suggested and they did not work.

tjbjmp

Mark,

How likely is it that two different companies did something to break the connection to DropBox on the same day at the same time?

DBinBigD

What I take away from this, is a lot more people use Epson Quick Connect than Brothers Web Connect. Based on the activity between the two posts. For my sake I hope there is enough noise on the Brother side that it eventually gets fixed as well.

BenDBX

Hi Everybody,

Thanks for bringing this to our attention. I've flagged this issue with our Engineering team to take a deeper look. We'll let you know when we have more information to share.

Thanks,

Ben

I don't think the issue is with epson or brother but dropbox. but again I am just frustrated user not assoiciated with dropbox. I am just waiting for a fix as is everybody else.

Slegnor

Same issue here, the fact Epson's Scan to Cloud settings can see my Dropbox file structure proves it's not Epsons issue but Dropbox's

adesilva70

Have the same issue. Haven't been able to solve it.

szh

Same problem- same run through of options including updating all software. No solution.

Having the exact same issue since last week! I have an 580-W

tpack424

I'm having the exact same issue! My printer is an epson wf3520

It's a DropBox issue! @Dropbox please respond to Epson!!

Hello XXXXX,

Thank you for your patience in this matter!

We are checking with our engineers on this issue (Dropbox - scanned files are not uploading) but have not heard back yet.

It seems to have been broken recently after a Dropbox Data breach. Perhaps Dropbox changed an authentication algorithm and 3rd party vendors like Epson were not informed.

We will update you as soon as we hear back from our engineers.

Thanks for your understanding.

Very Best Regards,

XXXXXX

Epson Product Support

AST2

Hey Ben,

Any update ? Most of us are now looking down the barrel of three plus days of re-work. Would really like it not to be four days. There is no doubt you guys tried to fob this off initially. See early posts from your team. And it looks as if it has cost you users. It would be great if you accepted responsibility and got a fix in ASAP so as not to cost us all more money. Any update would be greatly appreciated.

Yeah I'm looking at leaving to Box. This is crazy!

Orangeboom

I think I'm going to leave dropbox as well. I'm able to scan to OneDrive and Google Drive.

@Ben tell your engineers to respond to Epson engineers. They say they've reach out and Dropbox isn't responding...

Hello,
I am no expert but I want to share a response from Dropbox that seems to indicate that all API were cancelled and that users need to create a new one. I'm not sure if themis is done at user level or Epson level. The message was sent to me in french. Use google translate to get an idea of the content :

Nous avons expiré votre mot de passe et vous avons déconnecté de tous les appareils que vous aviez connectés à Dropbox Sign afin de protéger davantage votre compte. La prochaine fois que vous vous connecterez à votre compte Sign, vous recevrez un e-mail pour réinitialiser votre mot de passe.

Par mesure de précaution supplémentaire, nous vous recommandons fortement de faire pivoter votre clé API en générant une nouvelle, en la configurant avec votre application et en supprimant votre clé actuelle pour garantir la sécurité de votre compte.

Nous allons restreindre certaines fonctionnalités des clés API pendant que nous coordonnons la rotation. Seules les demandes de signature et les capacités de signature continueront d'être opérationnelles pour la continuité de votre activité. Une fois que vous aurez alterné vos clés API, les restrictions seront supprimées et le produit continuera à fonctionner normalement. Voici comment créer facilement une nouvelle clé.

Enfin, si vous avez réutilisé votre mot de passe Dropbox Sign sur d'autres services, nous vous recommandons fortement de modifier votre mot de passe sur ces comptes et d'utiliser l'authentification multifacteur lorsqu'elle est disponible.

In other words it appears Dropbox had a security breach that they solved by disconnecting everyone and now they are telling us "sorry and too bad, you are on your own. You fix it" NASTY!

Sebastian Wittig

If Dropbox had a security breach the only valid response is to invalidate related keys/tokens.

And the only way to fix our problem would then actually be on Epson/Brother side to get new keys. That´s just how this works afaik.

But we don´t know if this is the case. We only have people making assumptions.

If this would be made more transparent here, people wouldn´t be as angry.

@dbox_: By now you should give us some real information. Otherwise we have to look for different solutions.