Data Breach with DB Business

[sullivanlawaz]

Our firm in the past used DB business to share documents.  Recently, a link provided to an opposing party, when clicked on, allowed access to other client's documents (not shared or associated with the link).  Has this happened tp anyone else? How is it even possible?

[Mark]

Who clicked on the link and have you actually seen this? 

Its actually quite a common comment on here that Person A creates link and clicks to test and then panics when they realise they can see everything - but thats only because when theyve clicked on it Dropbox knows its them so shows it as though they are logged in (as they are!). Same would happen if it was somebody else on the team. 

[sullivanlawaz]

The opposing party clicked on it and was able to see documents for my other clients, not related to his case.  Each time the link was clicked, a different client's documents were accessed.  It was a major confidentiality breach, and I'm having to respond to the State Bar about it.

[Hannah]

Hey @sullivanlawaz, thanks for posting to our Community.

This is quite a strange situation. 

First of all, please know that a Dropbox shared link can be deleted at any time, to make sure that no-one can access the contents any more.

But can you please advise on how the link was created and shared? 

Did someone within this Dropbox Business team create it, or someone outside the team?

Keep me posted.

[sullivanlawaz]

All; someone in the firm created the link in the drop box business program, in our office.

The links have now been deleted, but the recipient was able to access other files, not associated  with the link.

[Jay]

Hi @sullivanlawaz, are you certain that none of these links pointed to an entire folder, which allows access to all the subfolders within?

Was this only occurring for one specific person, or did other people access the same link and get the same behavior?

[sullivanlawaz]

are you certain that none of these links pointed to an entire folder, which allows access to all the subfolders within?

Yes; the access was to a subfolder, not to the entire folder.  When the link was clicked, the link allowed access to another, separate subfolder.  When it was clicked again, the access was to a different subfolder.  

Was this only occurring for one specific person, or did other people access the same link and get the same behavior?

Several different people were able to access different folders, using the same link.

[Nancy]

Hi @sullivanlawaz, hope you don’t mind if I join the conversation. 

To my experience, a shared link should only point to the specific folder/file for which you created it.

Can you please try to create a shared link to one of your subfolders again, and then open it via an incognito window on your browser, while not signed in to any Dropbox account? 

I’d like to see if the same thing will happen, so that we can investigate further. 

Let me know how it goes!

[sullivanlawaz]

We were not able to replicate what occurred, although it happened twice, with 2 different unique links.

When myself and/or my staff went back into dropbox, created a new link, and clicked it, the proper documents (and only those documents) were able to be accessed.

[Jay]

As you mentioned that you've deleted the link, it wouldn't be possible for the team to investigate further.

in general, it isn't possible for a shared link to give access to folders that aren't contained within the link itself. There has to be another factor which could have caused this, or the method in which the link was created or shared. 

As you mentioned this was a Dropbox Business team at the time, was the shared folder within a team folder? 

When you or the others accessed the links, were they logged into any Dropbox account at the time, or were they not logged in at all?