None of the 5,000 affected Dropbox accounts had two-factor authentication enabled

Assessment

The Register reports this from Dropbox and it is consistent with how the attack worked: Dropbox enforces 2FA at login regardless of which identity provider asserted the email, so an account with 2FA on would have stopped the attacker at the second factor. Users who reported enabling 2FA after a mid-August alert also reported no further access. Dropbox has not published the figure itself, but it is the one number in the incident that describes the affected population by cause rather than by count.