- Hackers exploited Lenovo’s flawed email verification to hijack ~5,000 Dropbox accounts
- Attackers created Lenovo IDs with victims’ emails, bypassing login; 2FA absence worsened impact
- Dropbox ended Lenovo ID logins, expired sessions, and urged password changes plus 2FA setup
Around 5,000 Dropbox user accounts were compromised when hackers found a vulnerability in the Lenovo ID verification process. What does a Lenovo flaw have to do with people’s Dropbox accounts, you might ask? Here is what happened:
Earlier this week, Dropbox started notifying affected individuals about the incident. In the data breach notification email, the company explains:
“Dropbox partners with Lenovo as an identity provider so that users can log in to their Dropbox accounts using verified Lenovo IDs. While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address.”
Fixing the flaw
In other words, all criminals needed to have to pull this off was people’s email addresses. Using that information, they created Lenovo IDs and simply waltzed right into Dropbox accounts.
The attack took place between August 4 and 21, the company further said, adding that most of the accounts that were accessed did not have 2FA enabled. In around a third of them, there is evidence stored documents were either viewed or downloaded.
The vulnerability has since been addressed, and further steps taken to protect Dropbox users’ privacy. The company said it “promptly expired all sessions logged in through Lenovo IDs,” and terminated all links between Lenovo and Dropbox accounts. Now, it made it mandatory to submit a password when logging in through a Lenovo ID.
“No one can access your Dropbox accountt said. Still, it urged users to change their passwords, enable two-step verification, and change the password for their email accounts
“Every single one of the compromised accounts lacked multi-factor authentication. In 2026, for cloud storage accounts holding data, that’s an indefensible gap and it’s one that users could have closed themselves regardless of what Lenovo or Dropbox did or didn’t do with their legacy integration,” said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.
“The combination of an unreviewed third-party authentication pathway and accounts without MFA is essentially an open invitation. The practical lesson is straightforward and applies well beyond this specific incident. Every organisation and every individual should periodically audit what third-party services have authentication access to their accounts. OAuth grants, SSO connections, and third-party login integrations accumulate silently and rarely get removed when the relationship that created them ends.”
