GoKawiilDropbox users hit by account takeovers tied to Lenovo ID verification bug
Dropbox has notified some customers that attackers broke into their accounts by exploiting a flaw in Lenovo's email verification system, which let them register a fraudulent Lenovo ID tied to the victim's email address. Because Dropbox's login integration trusted Lenovo's identity assertions without independently confirming account ownership, attackers could log in without knowing the victim's Dropbox password. Dropbox says the intrusions occurred between August 4 and August 21, and Lenovo has attributed the issue to a legacy integration between its ID system and Dropbox.