Dropbox is investigating reports that some European users are receiving spam to email addresses associated with their accounts, the company said Tuesday.
Dropbox, whose cloud storageservice is widely used, said in astatement that “we know it’s frustrating not to get an update with moredetails sooner, but please bear with us as our investigation continues.”
On the company’s user forum, an apparent Dropbox employee wroteearly Wednesday morning that the company had brought in a team ofoutside experts but so far had no reports of unauthorized activity onaccounts. A 20-minute outage on Tuesday afternoon was not connectedwith the spam, he wrote.
The spam appears to be linked with Dropbox since many users reportedonly receiving the spam on an email address used only for Dropbox. Thespam, written in German, English and Dutch, advertises gamblingwebsites, according to users on Dropbox’s forum.
The spam came fast and furious forsome, with one userreporting that five spam emails arrived within 11 minutes. Forum userstheorized on how the breach of the addresses may have occurred, whetherthrough a vulnerability within Dropbox or some other compromise.
“It may very well be that the Dropbox database has beencompromised externally or internally,” wrote one user. “This would be avery serious issue and we should all leave the service if this was thecase, given that security is their business, but let’s give them achance to see if it’s some external factor.”
Another user wrote that he immediately closed down his Dropboxaccount after receiving the spam and opened a fresh account. But thenew one — also only linked with a unique email address not used forany other registrations — was hit immediately.
“Maybe a third-party-tool is leaking the addresses?” the userwrote. “If internal Dropbox algorithms are the culprit, my concerncouldn’t be greater. I love Dropbox, so I’m hoping for a quicksolution.”