GoKawiil
Tech News
Dropbox notified users that roughly 5,000 accounts were accessed without authorization between August 4 and 21, 2026, with files downloaded from about 1,500 of them. The breach traces to a single sign-on integration with Lenovo IDs, where a gap in Lenovo's email verification let attackers register accounts under victims' email addresses and log into their Dropbox accounts without needing inbox access.
Dropbox has notified some customers that attackers broke into their accounts by exploiting a flaw in Lenovo's email verification system, which let them register a fraudulent Lenovo ID tied to the victim's email address. Because Dropbox's login integration trusted Lenovo's identity assertions without independently confirming account ownership, attackers could log in without knowing the victim's Dropbox password. Dropbox says the intrusions occurred between August 4 and August 21, and Lenovo has attributed the issue to a legacy integration between its ID system and Dropbox.