Dropbox Users Targeted By Spam, Possible Address Leak To Blame? (Update: Dropbox Sees Outage)
Some Dropbox users have begun reporting that their accounts are under attack from spam, but what's more troubling is that, in select cases, the spam is hitting accounts where users claim …
Context & Ripple Effects
Dropbox enters this story from a position of strength: founded in 2007, it is by mid-2012 the leading player in cloud hosting and synchronization, and just a week earlier it doubled Pro subscribers' storage at no extra cost as competition with rivals like Box.net heats up. That makes the timing awkward — the company is leaning hard on consumer goodwill and paid upgrades at the exact moment its accounts come under question.
What changed on July 17 is twofold: users report spam arriving at accounts where they claim the address was used only for Dropbox, fueling suspicion of an address leak — though that cause remains unconfirmed — and Dropbox itself is dealing with a service outage at the same time. The story's spread to CNET, ZDNet, and Krebs on Security on or about the same day signals that security watchers, not just gadget press, see it as more than routine spam noise.
First-order effects
- Affected Dropbox users face targeted spam at addresses tied to their accounts, and until the leak theory is confirmed or ruled out, the burden falls on them to change passwords and audit which services share each address.
- Dropbox absorbs a trust hit precisely while courting paid Pro upgrades, and the concurrent outage compounds the impression of a service under strain.
Second-order effects
- Rivals like Box.net gain a ready-made differentiation argument: with storage space now effectively commoditized by Dropbox's own doubling move, security posture becomes the next axis on which enterprise and prosumer buyers compare sync providers.
- If a leak is confirmed, Dropbox would face pressure to force credential resets and add account protections — costs and friction that land directly on its conversion funnel.
Third-order effects
- Consumer cloud storage competition shifts from capacity giveaways toward verifiable security practices, pushing the whole category toward stronger authentication norms as table stakes rather than features.
- The episode feeds a broader pattern in which user-reported anomalies, amplified by security-focused outlets like Krebs on Security, force vendors to disclose incident details faster than their own incident-response timelines would prefer.
The trend: Cloud storage rivalry in 2012 is pivoting from storage-capacity giveaways to security and trust as the deciding factor for paying users.