Unauthorised access to Dropbox data on GitHub

Dropbox has released a statement acknowledging that it was the victim of a phishing campaign that was exploited to gain access to code stored on GitHub. Specifically, GitHub alerted Dropbox to suspicious behaviour whereby a third party impersonated CircleCI (a continuous integration and delivery platform) and gained access to the account.

Overall, the attacker gained access to 130 code repositories, including thousands of names and email addresses of Dropbox employees, as well as current and former customers, sales leads and suppliers. Additionally, the attacker gained access to copies of modified third-party libraries, internal prototypes, and some tools and configuration files used by the security team.