Some Dropbox accounts were wide open for about four hours on Sunday.
The company reported in a blog post that the problem was caused by a buggy code update that went undiscovered from 1:54 PM to 5:46 PM PDT on Sunday 19 June.
The post said during that time "some… [users] could have logged into an account without the correct password".
Dropbox said that all accounts with login activity during the affected period have been notified.
Dropbox came under fire in April for a change in its Terms of Service that allows it to turn over unencrypted files if requested by the U.S. government.