Unauthorized Access to Dropbox Accounts Linked to Lenovo ID Flaw
Dropbox has recently informed users about unauthorized access to their accounts stemming from a security flaw related to Lenovo ID authentication. The incident reportedly exploited how Dropbox managed single sign-on (SSO) through Lenovo IDs. According to Dropbox, an issue with Lenovo's email verification process permitted unauthorized individuals to register Lenovo IDs using the email addresses of other users. These attackers then accessed the Dropbox accounts associated with those addresses.
The unauthorized access occurred between August 4 and August 21, 2026. Dropbox indicated that while accounts were accessed without permission, their logs showed no evidence of files being viewed or downloaded. A spokesperson noted that approximately 5,000 Dropbox accounts were impacted, with less than a third of these accounts having files accessed. Affected users received direct communication from Dropbox, and those who did not receive an email were informed that their accounts were not compromised.
One affected user, developer Yoni Levy, shared screenshots of the notification he received from Dropbox. The alert indicated that a new web browser had logged into his account from a location in the United Kingdom, despite Levy stating he had never created a Lenovo account and had not traveled to the UK.
The breach did not require victims to provide their Dropbox passwords or access their email inboxes. Dropbox explained that the affected accounts were linked to Lenovo IDs that lacked two-factor authentication, allowing attackers to use newly registered Lenovo IDs with matching email addresses to gain access without further verification.
This incident follows a series of security concerns affecting major online platforms. Recently, users of X reported a wave of unsolicited password-reset emails and unfamiliar login alerts, although X stated there was no evidence of a new breach. An engineer from X suggested that attackers might be trying to take control of accounts to access X Money.
