Dropbox has disclosed a significant security breach affecting its HelloSign eSignature service (recently rebranded as Dropbox Sign).