P2017-ND-106

On May 15, 2017, the Organization received an email from Dropbox referencing an access to a Dropbox account from Singapore, but noting that the location may be inaccurate because it was estimated using the IP Address recorded by Dropbox. The Dropbox account contained certain personal information of former and present clients of the Organization, as well as clients and research participants of other organizations or clinics. The Organization was unable to obtain additional details of the login from Dropbox (i.e., if files/documents were downloaded, accessed, viewed), despite repeated attempts to do so. The majority (but not all) of the information at issue was password-protected.