In the email, Dropbox explained: “While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo's email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address.” So, rather than viewing the two logins as separate, Dropbox/Lenovo treated them as one since both shared the same email address. “Damn, big security f***** by Dropbox,” wrote one user on the Hacker News forum as the hijacking came to light. “You should never allow linking of an existing account with a new login method without first confirming that the user is able to sign in with an existing method first!” The breach is concerning since Dropbox is often used to store sensitive files and documents. However, the scale of the attack is relatively small. Bloomberg reports that the hacker compromised only 5,000 accounts, none of which were protected by multi-factor authentication. Meanwhile, Lenovo has described the login issue as a “legacy integration” with Dropbox that both companies have worked to address. In some cases, Dropbox also appears to tell users, “Our logs show no evidence that your files were viewed or downloaded," adding, "To secure your account, we promptly expired all sessions logged in through Lenovo IDs. We also severed any link between Lenovo and your Dropbox account, and no one can access your Dropbox account via a Lenovo ID without first entering your Dropbox password.” Dropbox didn’t immediately respond to a request for .
So, rather than viewing the two logins as separate, Dropbox/Lenovo treated them as one since both shared the same email address. “Damn, big security f***** by Dropbox,” wrote one user on the Hacker News forum as the hijacking came to light. “You should never allow linking of an existing account with a new login method without first confirming that the user is able to sign in with an existing method first!” The breach is concerning since Dropbox is often used to store sensitive files and documents. However, the scale of the attack is relatively small. Bloomberg reports that the hacker compromised only 5,000 accounts, none of which were protected by multi-factor authentication. Meanwhile, Lenovo has described the login issue as a “legacy integration” with Dropbox that both companies have worked to address. In some cases, Dropbox also appears to tell users, “Our logs show no evidence that your files were viewed or downloaded," adding, "To secure your account, we promptly expired all sessions logged in through Lenovo IDs. We also severed any link between Lenovo and your Dropbox account, and no one can access your Dropbox account via a Lenovo ID without first entering your Dropbox password.” Dropbox didn’t immediately respond to a request for .
The breach is concerning since Dropbox is often used to store sensitive files and documents. However, the scale of the attack is relatively small. Bloomberg reports that the hacker compromised only 5,000 accounts, none of which were protected by multi-factor authentication. Meanwhile, Lenovo has described the login issue as a “legacy integration” with Dropbox that both companies have worked to address. In some cases, Dropbox also appears to tell users, “Our logs show no evidence that your files were viewed or downloaded," adding, "To secure your account, we promptly expired all sessions logged in through Lenovo IDs. We also severed any link between Lenovo and your Dropbox account, and no one can access your Dropbox account via a Lenovo ID without first entering your Dropbox password.” Dropbox didn’t immediately respond to a request for .
In some cases, Dropbox also appears to tell users, “Our logs show no evidence that your files were viewed or downloaded," adding, "To secure your account, we promptly expired all sessions logged in through Lenovo IDs. We also severed any link between Lenovo and your Dropbox account, and no one can access your Dropbox account via a Lenovo ID without first entering your Dropbox password.” Dropbox didn’t immediately respond to a request for .
Dropbox didn’t immediately respond to a request for .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
