Dropbox Sign customer data accessed in breach

Dropbox Sign suffered an incident where an attacker compromised a back-end service account and accessed customer data (emails, names, usernames, phone numbers, hashed passwords) and sensitive authentication material (API keys, OAuth tokens, MFA information). Dropbox says the breach was limited to the Sign environment, has reset passwords, logged users out, and is rotating API keys and tokens while notifying regulators and law enforcement.