Personal shared folders potentially accessed via stolen work device - can I view past activity?

[anonymous]

hi, i was sharing several of my folders with a work dropbox account to enable me to occasionally view them at work during some legal processes. 

unfortunately a work device with access to to the work dropbox account via the app was stolen and somehow the theives managed to access the device, as this was evident through the purchase of gift cards. 

is there any way I can see whether my personal folders & files were copied or downloaded from the device? I can see when I unshared the files, but nothing before that? 

what other action should I take? 

[Hannah]

Hey @anonymous, really sorry to hear about this.

Do you currently have login access to the account that was linked to that device?

If so, I would suggest logging in and going to the security page of the account settings.

From there you can remove the affected device from the account and if the account is a paid one, you can choose to remotely delete all of their Dropbox files from that device as well.

Regarding activity, you mentioned this was a work account, but what kind of plan is it on? Is it a Dropbox Business one?

Keep me posted.

[anonymous]

Hi Hannah

yes the breached device was a work device. I was sharing a couple of my personal folders with it. I still have access to my personal folders of course. I have unshared all of the folders and files with the work device and removed all but my own device from the list of devices and browsers. 

my question was whether I could see whether during the breach were any of my files 'copied' or exported at any point. this is not obvious in the 'file activity' window. In fact, the only file activity i see is when I un-shared the folders and files, nothing before. 

my own account is Pro, the work account was a free account. 

[Hannah · Accepted solution]

In that case, I'm afraid there's no way to access this kind of info, @anonymous.

Certain Business team plans have this option, but it has to do with actions taken by members of the team and it's not available retroactively (in case you wanted to upgrade to access the info).

If you've made sure that this particular device is no longer linked to the account in any way, I would also reset the account's password, just to make sure that the account is safe, but that's pretty much all there is.

I hope this helps.