Dropbox brings in outside team to investigate spam run

Dropbox is investigating reports that some European users are receiving spam to email addresses associated with their accounts, the company said Tuesday.

Dropbox, whose cloud storage service is widely used, said in a statement that “we know it’s frustrating not to get an update with more details sooner, but please bear with us as our investigation continues.”

On the company’s user forum, an apparent Dropbox employee wrote early Wednesday morning that the company had brought in a team of outside experts but so far had no reports of unauthorized activity on accounts. A 20-minute outage on Tuesday afternoon was not connected with the spam, he wrote.

The spam appears to be linked with Dropbox since many users reported only receiving the spam on an email address used only for Dropbox. The spam, written in German, English and Dutch, advertises gambling websites, according to users on Dropbox’s forum.

The spam came fast and furious for some, with one user reporting that five spam emails arrived within 11 minutes. Forum users theorized on how the breach of the addresses may have occurred, whether through a vulnerability within Dropbox or some other compromise.

“It may very well be that the Dropbox database has been compromised externally or internally,” wrote one user. “This would be a very serious issue and we should all leave the service if this was the case, given that security is their business, but let’s give them a chance to see if it’s some external factor.”

Another user wrote that he immediately closed down his Dropbox account after receiving the spam and opened a fresh account. But the new one — also only linked with a unique email address not used for any other registrations — was hit immediately.

“Maybe a third-party-tool is leaking the addresses?” the user wrote. “If internal Dropbox algorithms are the culprit, my concern couldn’t be greater. I love Dropbox, so I’m hoping for a quick solution.”

Send news tips and comments to jeremy_kirk@idg.com