Title is a bit inflammatory. No proof, simply a few short lists of usernames and passwords that (at the time of release) were valid to login to Dropbox.

Did they come from Dropbox? Not necessarily. Not everyone uses a unique username+password combination for each site.

A more accurate title would be something like: Dropbox accounts potentially compromised