---
title: "Directed Trust Dropbox Sign document incident"
description: "Directed Trust Dropbox Sign document incident. Company says client portal and other systems were unaffected."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-30"
canonical_url: "https://www.ally.security/incidents/directed-trust-dropbox-sign-document-incident-2026"
markdown_url: "https://www.ally.security/incidents/directed-trust-dropbox-sign-document-incident-2026.md"
stix_url: "https://www.ally.security/incidents/directed-trust-dropbox-sign-document-incident-2026/stix.json"
---

# Directed Trust Dropbox Sign document incident

Directed Trust discovered suspicious activity around July 7, 2026 involving its Dropbox Sign electronic-signature account. Investigators determined that an unauthorized actor accessed files containing personal information.

Last modified Oct 30, 2026 · 1 source

## Summary

- **Environment:** Directed Trust’s Dropbox Sign account
- **Operational impact:** Company says client portal and other systems were unaffected
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Directed Trust](https://directedcustody.com/) discovered suspicious activity around July 7, 2026 involving its [Dropbox Sign](https://sign.dropbox.com/) electronic-signature account. Investigators determined that an unauthorized actor accessed files containing personal information. [1](#source-1)

## Impact

Directed Trust limited the incident to documents submitted through that account. It said its client portal, other systems and customer account logins were unaffected. The public sample leaves the specific personal-information categories blank and supplies no population total. [1](#source-1)

## Timeline

### July 7, 2026 — Suspicious activity identified around this date

Directed Trust investigated access to its electronic-signature account. [1](#source-1)

### October 12, 2026 — Document review completed

The review identified potentially affected personal information. [1](#source-1)

### October 27, 2026 — Notification sample dated

The letter describes the account-specific incident and response. The [notification sample](https://oag.ca.gov/system/files/Directed%20Trust%20Company%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf) provides the account. [1](#source-1)

### October 30, 2026 — Briefing updated

This briefing was last reviewed and updated on October 30, 2026.

## Threat Group & Attack Vector

The account-level access mechanism is not disclosed. This notice does not establish a compromise of Dropbox’s wider service. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Directed Trust secured access, reviewed affected documents and completed that review on October 12. Its October 27 letter reported no evidence of fraudulent use and offered monitoring; the sample does not specify the service duration. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/directed-trust-dropbox-sign-document-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Directed Trust Company — notice of data incident

official · Directed Trust Company

<https://oag.ca.gov/system/files/Directed%20Trust%20Company%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Directed Trust Dropbox Sign document incident: Document review completed
2. **Affected Organization · 100% confidence · current**  
   Directed Trust Dropbox Sign document incident: Directed Trust Company
3. **Resulted In · 100% confidence · current**  
   Directed Trust Dropbox Sign document incident: Directed Trust limited the incident to documents submitted through that account. It said its client portal, other systems and customer account logins were unaffected. The public sample leaves the specific personal-information categories blank and supplies no population total.
4. **Resulted In · 100% confidence · current**  
   Directed Trust Dropbox Sign document incident: Directed Trust discovered suspicious activity around July 7, 2026 involving its Dropbox Sign electronic-signature account. Investigators determined that an unauthorized actor accessed files containing personal information.
5. **Occurred At · 100% confidence · current**  
   Document review completed: 2026-10-12
6. **Resulted In · 100% confidence · current**  
   Directed Trust Dropbox Sign document incident: Suspicious activity identified around this date
7. **Resulted In · 100% confidence · current**  
   Directed Trust Dropbox Sign document incident: Directed Trust secured access, reviewed affected documents and completed that review on October 12. Its October 27 letter reported no evidence of fraudulent use and offered monitoring; the sample does not specify the service duration.
8. **Occurred At · 100% confidence · current**  
   Notification sample dated: 2026-10-27
9. **Resulted In · 100% confidence · current**  
   Directed Trust Dropbox Sign document incident: Notification sample dated
10. **Occurred At · 100% confidence · current**  
   Suspicious activity identified around this date: 2026-07-07
11. **Resulted In · 100% confidence · current**  
   Directed Trust Dropbox Sign document incident: The account-level access mechanism is not disclosed. This notice does not establish a compromise of Dropbox’s wider service.

</details>