This page says: > we learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2

This page says: > we learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2012. Our analysis suggests that the credentials relate to an incident we disclosed around that time. There's a link to a page about that "incident", which says: > * usernames and passwords recently stolen from other websites were used to sign in to a small number of Dropbox accounts.* [...] A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses. This doesn't add up, does it? I mean, their account of the incident in 2012 is usernames and passwords were stolen from other accounts; this got the attackers into a Dropbox employee's Dropbox account; that contained "a project document with user email addresses". But now they're saying that "email addresses plus hashed and salted passwords" went astray. It seems to me that there's an important distinction between losing "a project document with user email addresses" and losing one with user email addresses plus password hashes.