File opened "x minutes ago" when I didn't open it?

Hi,

This also happened to me today. I was working on a single file and upon exiting noticed that many files I had not opened recently or within months were showing up as recently viewed. These files are in different folders. I do not share these files with anyone else. I changed my password, removed recent devices, and turned on TFA. Since then, I have only seen my activity.

Jonathan, did you find out what was causing this issue?

And to anyone who can help or confirm based on what I have shared, was my account hacked?

Megan

Hi @ee22, I'd be happy to help!

The most common case for this scenario is another, third-party app accessing these files.

If you have any other apps accessing your files, or an antivirus this could be it.

What I would personally suggest, is what you've already tried in regards to security steps. You can also have a look at your events page, to see more about your file activity there, and make sure nothing suspicious happened.

The Events page at www.dropbox.com/events gives you an overview of all activity in your account including files events (adds/edits/deletes), as well as adding or removing shared folders.

If you have any questions, let me know!

Hi Megan,

This still isn't settling well with me. Seeing all those files being opened felt like a violation of my privacy and I'm considering if this is an application I want to continue using.

How can I know for sure if this was a hacker versus a third-party application?

Hey @ee22 - sorry to jump in here, but I just wanted to mention that the events page would be your best bet to find out more about what happened in this case.

Did you take a look to see if the actions are logged there and if so, check the user or the application that initiated them?

Apart from that, you can have a look at your Security page for any unknown devices or web sessions.

Hi Walter,

I've returned to this thread because my issue happened again.

When I am on the homepage (https://www.dropbox.com/home) and I filter the 'All Files' list by 'Recent' I see activity that files have been opened that I have not recently visited. But when I look at the Activity log you mentioned, that appears to be accurate.

Why is this happening? Is this a security-related issue?

Thanks.

Thanks for the nudge on this @ee22

Could you let me know if you notice any difference in the Recents area if you log into your account through another browser?

Also, where do you usually access your files from? Is it locally on your devices, through the website or via a 3rd party app/integration?

Same issue on Safari (Version 15.6.1) and Chrome (Version 121.0.6167.184) I access my files on my computer and through the Paper app (iOS). All three reflect the same recent activity

Thanks for the additional information @ee22

Would it be OK if we sent you an email to have a further look internally at this point?

Yes please

Sure thing @ee22 - you've got :envelope:

I just experienced the same issue as these users. Can someone from Dropbox please get in touch to look into this for me?

Jay

Hi @jhardy2025, what device are you using and could you attach a screenshot showing the information you're describing?

It's a Macbook.

Attaching a screenshot of my file list will publish at least the names of my files, I'm not inclined to do that.

Here is what happened: I opened my recent items folder on Finder on the Macbook to find that 10 MS Word documents in my dropbox folder on the computer had been opened around the same time a day earlier. It was not me and no one else had access to the computer. None of the files had been modified, only opened. I'm trying to determine if I've been hacked, this was the function of third-party app (although no third-party apps have access to my dropbox folder), a function of something that happened on Dropbox, or something else. Please assist if you can.

Jay

Have you opened Word recently and navigated manually to the Dropbox folder where the app might've scanned for those files?

Do you have any security software running on your machine which could be running scans?

I have gone to the Dropbox folder, although the times when the files were opened was during a period when I was out of the house and away from the computer and the computer was (or should have been) asleep. I don't typically open files from within Word, I open them directly from the Dropbox folder.

As far as security software, nothing I'm aware of. And even if that were the case, it wouldn't explain for me why these particular files and no others (among hundreds of similar ones) were accessed.

Thanks for the additional information @jhardy2025 - most appreciated.

Can you have a look at your events page and/or check the files' version history and let me know what you find?

Do you see any 'unknown' devices or web sessions on your Security page by any chance?

I did look at the security page and didn't see any unrecognized or unknown devices there.

I also looked at the events page. There were no events listed for the files that said they were opened in my local dropbox folder.

I see, thanks for clarifying that for me @jhardy2025

Can you maybe send us a screenshot of where you spotted this omitting any personal or sensitive information so that we can have a visual too?

I'm confused, what do you want me to take a screenshot of?

The place where you noticed that these files were accessed @jhardy2025 - apologies if it wasn't clear before.

It was in my dropbox folder on my hard drive. It was 10 MS Word documents. They had each been opened around the same time (I was not using my computer at the time), but none had been modified.

I'm attaching a screenshot of the "Date Last Opened" column for recent documents on my Mac. All of these documents are from my Dropbox folder on my hard drive. As you can see, several Word documents were opened in short succession (there were more, but because I accessed them later they have a more recent date last opened tag now). I did not personally access any of these documents (most had been dormant for a significant time) and I was away from my computer when this occurred. Nor was I linked to dropbox with any other device.

Thanks for the screenshot and clarification on this @jhardy2025

Would it be OK if we sent you an email to have a further look internally at this point?

Yes, please do.

Yes, please do.

3.18.25: Hi, Walter - I never received any follow up on this. What did you find out?

Megan

Hey @jhardy2025, I just sent you an email.

Reply back to me, and we'll take it from there!