Dropbox faces new class action lawsuit over data breach

A new class action lawsuit has been filed against Dropbox, alleging the company failed to adequately protect thousands of customers from a significant data breach. The lawsuit, initiated by plaintiff Steven Guiffre, claims that Dropbox neglected necessary security measures to prevent a breach on or before April 24.

This incident follows a major 2012 breach that impacted 68 million users and was deemed the largest hack in cloud server history. The extent of the current breach remains unclear, but it is estimated to affect at least several hundred thousand users. The compromised data includes user emails, usernames, phone numbers, hashed passwords, multi-factor authentication details, and general account settings.

According to the lawsuit, the plaintiffs’ personally identifiable information (PII) was exposed to an unknown third party, posing a significant risk of future fraud and identity theft. The complaint states, “The PII of Plaintiff and Class Members was compromised through disclosure to an unknown and unauthorized third party—an undoubtedly nefarious third party that seeks to profit off this disclosure by defrauding Plaintiff and Class Members in the future.”

In addition to potential identity theft, the plaintiffs have incurred substantial costs in verifying the breach, monitoring credit, exploring identity theft services, and consulting legal advice. The lawsuit claims that plaintiffs have suffered actual injury due to the diminished value of their PII, which they had entrusted to Dropbox.

The recent lawsuit adds to Dropbox’s security challenges. In late 2022, the company disclosed another breach, where hackers accessed 130 code repositories, some source code, and the personal information of some customers and employees.