What is enough for one person may not be for another person (there are people who have no trouble seeing their computer infected by several backdoors and malware, as long as they still have Internet access it is enough for them...), so the core of your question may be really opinion based. I will try to stick to facts, it will be up to you then to decide if this is enough for you.
AFAIK, the DropBox hack itself is not new, it is just a confirmation regarding the actual data leaked during a hack which happened in 2012. It is now confirmed that the users database has been stolen, but passwords where (mostly) protected using correct protection measures using non-reversible cryptographic hashes.
This means that the stolen database did not contain your password literally, but only some kind of checksum derived from the password and allowing to authenticate you. What attackers will do is try to guess as much passwords as they can in this list by checking common words, alteration and characters combinations.
If your password was really strong, it is possible that it remains unknown despite the leak.
If the password is found, then:
Associated to your mail address and possibly other information, attackers will try to reuse it to get access no only to DropBox, but also to other accounts you may own elsewhere. To the attacker, such accounts may be of value either directly (trivial example: order some goods at your own expense) or indirectly (for instance by impersonating you asking for monetary help to your relations).
The password will be added at the bottom of their list of well-known passwords to be tried on further leaks or to feed robots crawling the web trying to get access to some random accounts.
So, to summarize:
Regarding your access to DropBox itself (or any other service you may use offering similar 2 factor authentication), in the worst scenario its security will now only reside in the Google Authenticator security, but you may find it "enough",
Regarding your password, two scenarios:
Either it was not really complex (more easy to remember and type quickly) or contained less than 8 characters: consider it screwed, attackers do know it. If there are other services accepting your email as login and this password for authentication and opening the possibility of any direct or indirect benefit to the attacker, then consider that it's just a matter of time before some attackers will get access to these services.
Either it was complex, then it's merely a matter of luck. Whether you consider this sufficient or not is completely up to you and your use-case.