GoKawiilDropbox users hit by account takeovers tied to Lenovo ID verification bug
Dropbox has notified some customers that attackers broke into their accounts by exploiting a flaw in Lenovo's email verification system, which let them register a fraudulent Lenovo ID tied to the victim's email address. Because Dropbox's login integration trusted Lenovo's identity assertions without independently confirming account ownership, attackers could log in without knowing the victim's Dropbox password. Dropbox says the intrusions occurred between August 4 and August 21, and Lenovo has attributed the issue to a legacy integration between its ID system and Dropbox.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how third-party single sign-on integrations can become a weak link even when the primary service's own password security is unaffected. It highlights the risk of federated identity systems that extend trust across companies without adequate cross-verification, potentially exposing users who never even signed up for the partner service.
- A flaw in Lenovo's email verification let attackers create fake Lenovo IDs linked to victims' emails.
- Dropbox's SSO integration trusted these fraudulent IDs, letting attackers log in without passwords.
- Affected logins occurred between August 4 and 21, prompting Dropbox to alert users to reset passwords and enable 2FA.
YubiKey 5C NFC Security Key — When an email-verification flaw lets someone into your cloud storage without your password, a hardware security key is the strongest backstop you can add. The YubiKey 5C NFC plugs into USB-C or taps to your phone over NFC and works as a second factor for Dropbox and many other accounts, so a fraudulent identity link isn't enough to get in.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-02
Published there as: “Dropbox accounts breached through Lenovo email verification flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.