We want to make you aware of a recent effort by certain third-party bad actors to leverage free Box developer accounts in a social engineering attack on certain Box free individual accounts. Upon discovery of this issue, Box decided to temporarily disable new sign-ups for free developer accounts while we work to implement additional technical controls to prevent similar efforts in the future. The security and integrity of our Service is of utmost priority to Box, and we must ensure that we are providing the most secure product experience to our customers.
We understand that some Enterprise customers use these free developer accounts for their own business purposes, and that they may have questions about their inability to sign-up new free accounts. Please use the following talking points when addressing these Customers’ questions or concerns:
- Any free developer accounts that were in place before March 9, 2023 are unaffected by this action;
- Customers may continue to use these pre-existing accounts, in particular they may continue to invite new/additional collaborators within their organization to work within those existing developer accounts;
- Enterprise customers always have the ability to start a sandbox environment for non-production development purposes.
- No timeline for turning the console on, but we are working through making the process more secure.
As updates become available, we will share those more broadly with account teams and any customers who have questions about this issue. In the meantime, please reach out to box-notifications-team@box.com with additional questions or concerns.