Dropbox accounts breached through Lenovo email verification flaw

The security incident involved exploitation of a vulnerability in Lenovo's email verification process that allowed attackers to create fraudulent Lenovo IDs tied to victims' email addresses. Dropbox uses Lenovo Identity Provider Services for authentication, enabling users to log in via Lenovo IDs. The flaw permitted attackers to bypass Dropbox's password requirement by using these fraudulent Lenovo IDs to access Dropbox accounts associated with the same email addresses. Dropbox detected unauthorized access to approximately 5,000 accounts during August 4–21, 2026. In response, Dropbox invalidated all sessions authenticated via Lenovo IDs and introduced a new login requirement mandating Dropbox account passwords alongside Lenovo ID authentication. Lenovo stated the issue stemmed from a legacy integration and confirmed Lenovo customers were not impacted.

Approximately 5,000 Dropbox accounts were accessed without authorization. Attackers could view and download content from some compromised accounts. The breach bypassed Dropbox's password authentication by exploiting trust in Lenovo's email verification process. Lenovo customers were not affected. The incident exposed user data confidentiality and potentially integrity due to unauthorized access and data exfiltration.

Dropbox and Lenovo have collaborated to mitigate the risk by expiring all sessions authenticated through Lenovo IDs and requiring users to enter their Dropbox account password when using Lenovo ID authentication. Users impacted have been notified. No further immediate action is indicated beyond following Dropbox's updated login requirements. The investigation is ongoing, and users should monitor communications from Dropbox for updates.