Legacy Lenovo login opens 5,000 Dropbox accounts to attackers
Dropbox has warned roughly 5,000 users that attackers hijacked their accounts by exploiting a legacy login integration with Lenovo. The flaw stemmed from a weakness in Lenovo's email verification process, which let attackers register Lenovo IDs using victims' Dropbox email addresses and then use those IDs to log straight into the corresponding Dropbox accounts without ever needing the actual Dropbox password. The incident highlights the risks of third-party login integrations and the importance of two-factor authentication, since none of the affected accounts had it enabled.
The breach ran from 4 to 21 August, and Dropbox says attackers accessed files in fewer than a third of the compromised accounts. One affected user, Bitcoin security expert Jameson Lopp, said attackers only tried to open a single locally encrypted file. Dropbox has since expired all sessions linked to Lenovo IDs, severed the integration entirely, and is urging affected users to reset their Dropbox and email passwords and turn on 2FA. Lenovo says its own systems and customers were not affected and that it is still investigating.
In short
- Legacy Lenovo login flaw let attackers into ~5,000 Dropbox accounts.
- Breach lasted 4–21 August; no victims had 2FA enabled.
- Dropbox severed the Lenovo integration and urges password resets.
Explained simply
Dropbox is a cloud storage service where people keep files and access them online. It allowed users to sign in through Lenovo, a computer maker, using a Lenovo ID instead of their Dropbox password.
This kind of connection between services can make signing in simpler, but it also means one service’s login checks can affect access to another. Two-factor authentication adds a further check, such as a code, alongside a password.
The incident involved about 5,000 Dropbox accounts, and files were accessed in some of them. It drew attention to how services verify identities and protect accounts linked through older sign-in systems.