Dropbox users, it may be time to update your passwords and enable two-factor authentication. A hacker claims to have stolen some 7 million usernames and passwords for the popular cloud-based file storage and sharing service.

Someone posted a series of links on reddit Monday evening to files that purportedly contain a sample of the stolen usernames and passwords. Several redditors say at least some of the passwords were working at the time they were posted.

Anton Mityagin, from the Dropbox security team, wrote in a blog entry that the company’s servers were not hacked.