Tuesday 15 September 2026
Evening EditionRSS

ZOTPAPER

News without the noise

ZOTPAPER
Security

Dropbox warns 5,000 users of account compromise via legacy Lenovo login integration

Attackers exploited email verification flaw to access storage accounts; no two-factor authentication enabled on affected users

edit
By LineZotpaper
Published
Read Time2 min
Dropbox has notified approximately 5,000 customers that their accounts were compromised after attackers abused a legacy integration that allowed users to log in using Lenovo IDs. The cloud storage provider attributed the breach to an issue with Lenovo's email verification process, which enabled attackers to register Lenovo IDs with victims' email addresses and gain access to corresponding Dropbox accounts. The compromise lasted from August 4 to August 21.

In an email to affected customers, Dropbox said attackers exploited an integration that allowed users to access their accounts via Lenovo IDs. The company blamed "an issue with Lenovo's email verification process" without specifying why the integration did not require a Dropbox password for access.

Dropbox told Bloomberg that attackers accessed files belonging to fewer than one-third of the affected users. Jameson Lopp, co-founder of Bitcoin security company Casa, said attackers attempted to access just one of his files, "IMPORTANT.rtf," which had been encrypted locally before it was uploaded to Dropbox. "Sometimes, it pays to be a nerd," Lopp remarked.

Dropbox confirmed to Reuters that none of the compromised accounts had two-factor authentication (2FA) enabled. After discovering the breach, Dropbox said it "promptly expired all sessions logged in through Lenovo IDs" and "severed any link" between the affected accounts and Lenovo. The company advised affected users to change their Dropbox and personal email passwords and enable 2FA.

Lenovo told Reuters that its customers were unaffected and that its investigation was continuing. The Register has sought additional comment from both companies.

§

Analysis

Why This Matters

  • The breach highlights risks of legacy third-party authentication integrations, especially when they bypass standard password prompts.
  • Affected users who did not have 2FA enabled were left vulnerable; the incident underscores the importance of security measures like encryption and multi-factor authentication.
  • The attack could have broader implications for trust in cross-platform login systems used by major tech companies.

Background

Dropbox and Lenovo have had a long-standing partnership allowing users to link Lenovo IDs to Dropbox accounts for convenience. This integration, now considered legacy, appears to have been maintained without the same security hardening applied to newer authentication methods. The incident occurred during a period of heightened scrutiny of identity management and account takeover risks.

Key Perspectives

Dropbox: The company acted quickly to sever the integration and expire active sessions. It has advised affected users to change passwords and enable 2FA, but has not publicly detailed why the integration allowed password-less access. Lenovo: The PC maker stated that its own customers were unaffected and that an investigation is ongoing. It has not yet disclosed whether the email verification flaw has been patched. Security experts: Jameson Lopp's experience demonstrates that local encryption can mitigate the damage of account takeovers. However, critics note that the lack of 2FA on affected accounts represents a preventable security gap.

What to Watch

  • Whether Lenovo's investigation reveals a broader vulnerability in its ID verification system that could affect other services.
  • Dropbox's response: will it discontinue legacy integrations or introduce mandatory 2FA for users with such integrations?
  • Potential regulatory scrutiny: if sensitive data was accessed, this could attract attention from data protection authorities.

Sources

newspaper

Zotpaper

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.

Editorial ProcessSubscribe