At one point Dropbox asked users who hadn’t changed their password since mid‑2012 to update it as a precaution. The company said the credentials in question appeared to come from an older incident and encouraged affected users to choose a new, strong password and to enable two‑step verification.
Why this matters
When a service asks a group of users to reset passwords it’s usually acting on evidence that old credentials may have been exposed elsewhere. That doesn’t always mean accounts were accessed, but it does increase risk — especially if you reuse passwords across sites.
If you get a prompt: what to do right now
- Change the password immediately. Choose a unique, strong password the service hasn’t seen before. Long passphrases or randomly generated passwords from a password manager are the easiest way to be both secure and practical. - Don’t reuse passwords. If you have used that same password on other sites, change it on those sites now. - Enable two‑step verification (two‑factor authentication). This adds a second defence layer, usually a code from an app or a hardware key, and greatly reduces the chance a stolen password will let someone in. - Use a password manager. It generates, stores and autofills strong, unique passwords so you don’t have to remember them. - Review and tidy connected apps and devices. After you’ve changed the password, check your account’s security or settings area and revoke access for any unknown or unused apps and devices. - Sign out of sessions you no longer recognise. Many services let you sign out everywhere and then sign back in with the new password.
Steps to check your account after resetting
- Look at recent activity or sign‑in history to spot unfamiliar locations or devices. - Revoke any lingering app passwords or API keys you no longer use. - Check your recovery information: make sure your recovery email and phone number are still correct and belong to you. - Watch your inbox for official notices and be wary of phishing emails that ask you to re‑enter credentials. If you’re unsure, open the service directly in your browser rather than following email links.
If you don’t get a prompt
Not everyone will be asked to change their password, but that doesn’t mean you’re safe. If your password is old, simple, or reused across sites, change it anyway. Enabling two‑step verification and switching to a password manager are worthwhile moves whether or not a prompt appears.
Small habits that pay off
A one‑off password reset is useful, but long‑term safety comes from simple habits: unique passwords for every service, a password manager, and two‑step verification where available. Those three steps remove most of the benefit attackers get from leaked credentials and make your online accounts a lot harder to break into.
