GoKawiilDropbox says 5,000 accounts breached via flawed Lenovo SSO login
Dropbox notified users that roughly 5,000 accounts were accessed without authorization between August 4 and 21, 2026, with files downloaded from about 1,500 of them. The breach traces to a single sign-on integration with Lenovo IDs, where a gap in Lenovo's email verification let attackers register accounts under victims' email addresses and log into their Dropbox accounts without needing inbox access.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident exposes a common weakness in federated login systems: when one identity provider skips proper verification, it can undermine security across every service that trusts it, including Dropbox. It also highlights that Dropbox failed to require existing-account verification before linking a new SSO method, a basic safeguard that could have prevented the takeover entirely.
- About 5,000 Dropbox accounts were compromised, with files downloaded from roughly 1,500.
- Attackers exploited a gap in Lenovo's email verification to register accounts under victims' emails without inbox access.
- Dropbox did not require verification against existing logins before allowing the new Lenovo SSO to link, enabling the breach.
YubiKey 5C NFC Security Key — When single sign-on chains break down like this Dropbox incident, a hardware security key keeps account access tied to something only you physically hold. The YubiKey 5C NFC works over USB-C and NFC, so you can lock down Dropbox, Google, and other accounts on both laptop and phone.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: 9to5mac.com — Ben Lovejoy, 2026-09-02
Published there as: “Dropbox breach seemingly caused by egregious authentication failure [U]”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.