https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign

Here's the actual security advisory, which contains much more information than the fluff article about it.