This is such a colossal fuckup, they need to do a full postmortem and heads need to roll. This is a "you had one job" situation. This is all hands on deck. This is potentially company-ending. If this happened at Github it would be huge news.
The culture in the company would have to be fu*ked to allow this type of breach. There is no official Dropbox public letter or CEO apology post yet, seems like problem starts at the top with new CEO.