File internet hosting service Dropbox on Tuesday disclosed that it was the sufferer of a phishing marketing campaign that allowed unidentified risk actors to realize unauthorized entry to 130 of its supply code repositories on GitHub.
“These repositories included our personal copies of third-party libraries barely modified to be used by Dropbox, inner prototypes, and a few instruments and configuration information utilized by the safety crew,” the corporate revealed in an advisory.
The breach resulted within the entry of some API keys utilized by Dropbox builders in addition to “just a few thousand names and electronic mail addresses belonging to Dropbox staff, present and previous prospects, gross sales leads, and distributors.”
It, nonetheless, harassed that the repositories didn’t comprise supply code associated to its core apps or infrastructure.
Dropbox, which affords cloud storage, knowledge backup, and doc signing providers, amongst others, has over 17.37 million paying customers and 700 million registered customers as of August 2022.
The disclosure comes greater than a month after each GitHub and CircleCI warned of phishing assaults designed to steal GitHub credentials by means of pretend notifications purporting to be from the CI/CD platform.
The San Francisco-based agency famous that “a number of Dropboxers acquired phishing emails impersonating CircleCI” in early October, a few of which slipped by means of its automated spam filters to land in staff’ electronic mail inboxes.
“These legitimate-looking emails directed staff to go to a pretend CircleCI login web page, enter their GitHub username and password, after which use their {hardware} authentication key to go a One Time Password (OTP) to the malicious website,” Dropbox defined.
The corporate didn’t reveal what number of of its staff fell for the phishing assault, however mentioned it took immediate motion to rotate all uncovered developer credentials and that it alerted regulation enforcement authorities.
It additionally mentioned it discovered no proof that any buyer knowledge was stolen on account of the incident, including it is upgrading its two-factor authentication methods to assist {hardware} safety keys for phishing resistance.
“vigilant professionals can fall prey to a rigorously crafted message delivered in the appropriate method on the proper time,” the corporate concluded. “That is exactly why phishing stays so efficient.”
