> Based on our investigation, a third party gained access to a Dropbox Sign automated system configuration tool. The actor compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database.

Not familiar with this area, how usually does it happen? Social engineering or some more "technical" ways?

Also, under normal (not hacked) circumstance, who usually would have access to these service accounts?