My husband is music director at a church that uses DropBox, but never for sensitive data. He got a message yesterday from Norton (maybe, whatever he has for security on his desktop here at home) that his DropBox password has been compromised. It's the same for all 3 church employees (him, admin, priest) but never any PII. They use it to send the bulletins to each other for proofreading, that kind of thing. I won't use DropBox for my biz.