Urgent: Unauthorized access to my account and stolen files

Hi ​@cw2026, 

Welcome to Box Community, and we’re glad to assist!

I understand that this is an urgent security matter regarding unauthorized access and potential file exfiltration on your account. 

As part of our security guidelines, you should immediately take the following steps to secure your account and report this incident:

To prevent further unauthorized access, you should immediately terminate all active sessions and force a re-authentication:

• Log in to your Box account and navigate to Account Settings > Security tab.
• Scroll down to the Login Activity section. You will see a list of all active sessions. Click the "X" (Forget App) next to any unfamiliar locations, IP addresses, or devices. Alternatively, you can click "Forget All" to immediately expire all active access tokens and force any connected device or browser to re-enter credentials upon their next access attempt. 
• Change your password immediately to a strong, unique password.
• If you haven't already, set up MFA under your Account Settings to add an extra layer of security. 

This action will help secure your Box access as well as your contents. 

Hope it helps! 

Hello, 

I’ve already performed all of those steps, have all of the security notification emails, and require a more thorough trouble ticket resolution. I am requesting the following:

1. Preservation. Please preserve, and suspend any routine deletion/retention expiry of, all records associated with this account for June 1, 2026 to present, including: login and session records (successful and failed), source IP addresses, user-agent/device data, authentication method per event (web, API, OAuth token, app password), token and OAuth-application grant/creation/revocation history, password/MFA/recovery-address change events, and file access/download events. A preservation request from my attorney may follow under separate cover, and this matter may be referred to law enforcement (an FBI IC3 complaint is prepared).

2. Login history for the incident window. Please provide the login/session records for this account for July 6–20, 2026**, including per-login source IP, user-agent, and authentication method. I specifically need the detail behind the two alerts of July 13 at 18:36:21 UTC and 18:55:50 UTC, both displayed as "USA (Approximated from IP address Unknown)" — one of these was me; the other was not, and the alert emails carry no IP for either.

3. Token/app audit. Please confirm whether any API tokens, OAuth application grants, developer tokens, or app passwords existed on or were created for this account on or before July 13, 2026, and whether any survived my July 13 revocation of sessions and connected apps.

4. Your own flags. If Box's security systems flagged any of the July 13 sessions as anomalous or associated with known-abusive infrastructure, please note that in your response or preserve it for legal process.

Thank you.

​@Rona Box Following up on this. I emailed this same request to the privacy@box and LER@box and they re-directed me back to this forum and / or you.