how it happened
- whoattackercompromised a service account
- the gapover-privileged accountmore access than its job
- the resultcustomer dataAPI keys, OAuth tokens, MFA data
what everyone assumed
Service accounts feel like infrastructure, not identity: they run the machinery, they do not log in like people, they are nobody’s responsibility to watch. The assumption is that a background automation account is too peripheral to be a serious risk.
what happened
An attacker compromised the service account and found it could do far more than its narrow task implied. From there they reached customer API keys, OAuth tokens, hashed passwords, and authentication data, the keys to a whole user base, all through one over-privileged background identity.
step by step
- a back-end service account has more access than its jobOne automated identity in the Sign product.the assumption breaks here
- an attacker compromises itIt can do far more than its narrow task implied.
- 2024API keys, OAuth tokens and MFA data exposedThe keys to a whole user base, through one over-privileged account.
how it surfaced
In 2024 Dropbox disclosed that a compromised back-end service account in its Sign product had exposed API keys, OAuth tokens, and MFA data for users. The breach ran through a single non-human account with more access than its job required.
A service account is an identity with credentials and reach, and an over-privileged one is a master key nobody is guarding.
The plumbing has access, and access is what attackers come for.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAn attacker takes over the background account.what it costs youThey reach customer data and keys across the whole product through one forgotten account.
- or it goes like thisit happenedCash App / Block, 2022howThe person logs back in from home, weeks after leaving.what leavescustomer lists and reportswho ends up with itthe former employee and whoever they work for next
- or it goes like thisit happenedColonial Pipeline, 2021howThe forgotten account's password turns up in a breach dump.what leavesa working way into the networkwho ends up with ita ransomware crew
sources
your turn
what you can do about it
this week
List your service accounts and trim each one to what its task actually needs.
Your automations run on service accounts that were granted broad access for convenience and have not been reviewed since. One of them is likely a master key. Inventorying non-human identities and trimming each to what its task actually needs is the work the Dropbox Sign account skipped.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →