Dropbox Breach: 5,000 Accounts Compromised via Lenovo ID Flaw

Breach scope: Dropbox confirmed that roughly 5,000 accounts were compromised, with files accessed in fewer than a third of them.

Attack window: Unauthorized access occurred between August 4 and August 21 due to a flaw in Lenovo's email verification process.

Root cause: The flaw allowed attackers to register fraudulent Lenovo IDs and use them to log in to Dropbox accounts lacking 2FA.

Dropbox disclosed on Tuesday that approximately 5,000 accounts on its cloud-storage platform were compromised last month, with attackers viewing and downloading stored content. Some Dropbox users received an email on Monday notifying them that their accounts had been accessed without authorization between August 4 and August 21.

Dropbox Confirms Unauthorized Access Window

The company confirmed the incident after Bloomberg News first reported the hack earlier in the day. Approximately 5,000 Dropbox accounts were impacted, and fewer than a third of those accounts had files viewed or downloaded, a Dropbox spokesperson said .

A Broken Sign-In Bridge Between Two Companies

Dropbox partners with Lenovo , the computer maker, as an identity provider, allowing users to log in to their Dropbox accounts with a verified Lenovo ID instead of a Dropbox password – a common convenience feature known as single sign-on (SSO). The problem was in how that Lenovo ID got verified in the first place.

" Our investigation determined that an issue with Lenovo's email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address ," Dropbox told affected users.

Notably, this meant a victim didn't even need to have created a Lenovo ID themselves – an attacker could simply register a new one under someone else's email and use it to walk straight into that person's existing Dropbox account, bypassing the need for a Dropbox password or access to the victim's actual email inbox. Only accounts without Dropbox's own two-factor authentication (2FA) enabled were vulnerable to the trick.

Lenovo and Dropbox Respond

Dropbox told Reuters that it identified unauthorized access affecting accounts linked to a Lenovo ID lacking 2FA, prompting the company to terminate all sessions authenticated through a Lenovo ID.

Dropbox has since removed any links between Lenovo IDs and Dropbox accounts and reconfigured its systems so that users must enter their Dropbox password before accessing an account through Lenovo.

Lenovo, for its part, identified a "legacy integration" between Lenovo ID and Dropbox that " could be used to improperly authenticate certain Dropbox accounts ," adding that its own customers were not affected and that an investigation remains ongoing.

The CyberSec Guru noted the incident falls into the same flaw pattern behind CVE-2026-55075 (Coder) and CVE-2026-14781 (Keycloak) – relying parties using the email claim as an account-joining key across federated trust boundaries.

Regulatory Notification and Remediation

Dropbox said it had reported the incident to data protection regulators. The remediation steps – session termination, integration removal, and mandatory password entry – target the authentication vulnerability associated with the Lenovo ID pathway, closing the vector used to access the affected accounts.

In April 2024, a Dropbox breach was connected to its Dropbox Sign production environment. Dropbox disclosed in prior SEC filings that roughly 68 million user credentials from a 2012 breach were released publicly in 2016.

In other recent news, ShinyHunters said it gained initial access to McKesson through voice phishing (vishing) targeting employees, then leveraged compromised Okta SSO accounts to access McKesson's Salesforce and Snowflake environments.