Security incident involving Dropbox Sign

Navigation: Main_Page > Notifications > Security incident involving Dropbox Sign

Security incident involving Dropbox Sign

ActiveCampaign received a notification regarding a security incident associated with Dropbox Sign, a third-party e-signature service utilized by ActiveCampaign. This situation underscores the importance of security practices and vigilance in managing your account.

Introduction

On May 1, 2024, ActiveCampaign was alerted about a security breach from Dropbox Sign (previously known as HelloSign). The incident involved unauthorized access to Dropbox Sign's production environment, leading to the exposure of the names and email addresses of recipients linked to Dropbox Sign documents or agreements. It is crucial to note that there is currently no evidence to suggest that the contents of these documents were accessed.

Understanding security incidents is vital for users, as it helps them protect their information and maintain confidence in the services they use. ActiveCampaign acted swiftly upon notification, implementing immediate security measures recommended by Dropbox Sign to safeguard customer documents and agreements.

How to Access This Feature

Users do not need to access any specific feature relating to this incident, but remaining informed through official channels is essential. Keep an eye on updates posted on this page, where ActiveCampaign will share further information as the situation progresses.

Step-by-Step Instructions

In the event of a security incident, it is essential to follow certain steps to minimize risk:

1. **Stay Informed**: Regularly check for updates directly from the ActiveCampaign platform regarding the incident.
2. **Review Communications**: Evaluate any emails or messages related to your ActiveCampaign account for legitimacy.
3. **Enable Security Measures**: Ensure that multi-factor authentication is set up to add an extra layer of protection to your account.
4. **Report Concerns**: If you suspect that any communication is phishing or spoofing, report it to ActiveCampaign for further analysis.

Configuration Options and Settings

- **Multi-Factor Authentication**: Always enable multi-factor authentication for all users associated with your ActiveCampaign account. This provides an additional layer of security. - **Strong, Unique Passwords**: Encourage the use of strong and unique passwords to further secure your account.

Best Practices and Tips

To further safeguard your account and avoid phishing attempts, consider the following best practices:

• **Examine Embedded Links**: Hover over links to verify that they direct you to the expected and trusted webpages.
• **Avoid Opening Suspicious Attachments**: Do not open unsolicited attachments or click on suspicious links.
• **Watch for Red Flags**: Be wary of emails with poor grammar, misspellings, generic greetings, a false sense of urgency, or demands for action.
• **Regularly Update Security Measures**: Stay proactive regarding security features and update passwords on a scheduled basis.

Common Use Cases with Examples

It is crucial to understand how to react in the event of an incident. For example, if a user receives an email that appears to be from ActiveCampaign asking them to reset their password, they should:

• Engage their common sense to determine if the request seems odd.
• Check the sender's email address for any discrepancies.
• Look for unusual links or requests that do not align with normal procedures.

Troubleshooting Section

If you encounter issues or have concerns regarding the security incident, the following steps may help:

• **Verify Email Authenticity**: If uncertain about an email's legitimacy, cross-reference with the information on the ActiveCampaign website.
• **Contact Support**: If you have further questions or concerns, reach out to the ActiveCampaign security team at security@activecampaign.com for assistance.

Related Features

To better manage your security, consider exploring related features such as:

• Notifications
• Multi-Factor Authentication (see more details in the linked article)
• Password management practices

FAQ

Q1: What information was compromised in the Dropbox Sign incident? A1: Only the names and email addresses of recipients were exposed. There is no evidence of unauthorized access to the contents of documents.

Q2: What should I do if I received a suspicious email? A2: Always verify the sender, do not open suspicious links or attachments, and report the email to ActiveCampaign if you suspect phishing.

Q3: How can I protect my ActiveCampaign account? A3: Enable multi-factor authentication and use strong, unique passwords to enhance security.

Q4: Are documents sent through Dropbox Sign safe? A4: While the email addresses and names were exposed, there is currently no evidence that document contents were compromised.

Q5: How will ActiveCampaign keep me updated on this incident? A5: ActiveCampaign will post updates on this page regarding the status and findings related to the security incident.

Q6: How do I enable multi-factor authentication? A6: Instructions for enabling multi-factor authentication can be found in the ActiveCampaign documentation under that feature.

Q7: Who can I contact for further questions? A7: If you have additional questions or concerns, please contact security@activecampaign.com for dedicated assistance.

ActiveCampaign will continue to monitor this situation closely and provide updates as they progress through their investigation and gather more information from Dropbox Sign.