Dropbox admitted in 2012 that the emails were stolen. The new information coming to light now is that encrypted passwords were also leaked. Exact phrasing from

Dropbox admitted in 2012 that the emails were stolen. The new information coming to light now is that encrypted passwords were also leaked. Exact phrasing from 2012 blog post: >A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses. We believe this improper access is what led to the spam. We’re sorry about this, and have put additional controls in place to help make sure it doesn’t happen again.