Dropbox has confirmed that approximately 5,000 user accounts were compromised due to an exploit involving a legacy login integration with Lenovo. The cloud storage provider stated that attackers leveraged an issue within Lenovo's email verification process to gain unauthorized access to these accounts.
According to Dropbox, the vulnerability allowed attackers to register Lenovo IDs using the email addresses of existing Dropbox users. This then granted them access to the corresponding Dropbox storage accounts without requiring a separate Dropbox password. The company did not elaborate on why this integration bypassed the need for a Dropbox password.
The compromise period spanned from August 4 to August 21. Dropbox indicated that files belonging to fewer than one-third of the affected users were accessed during this time. One affected user, Jameson Lopp, co-founder of Casa, reported that attackers attempted to access a single file named "IMPORTANT.rtf" from his account, which had been locally encrypted prior to being uploaded to Dropbox.
Dropbox confirmed that none of the compromised accounts had two-factor authentication (2FA) enabled. Following the discovery of the breach, Dropbox immediately terminated all active sessions logged in via Lenovo IDs and completely severed the integration link between the affected accounts and Lenovo.
Affected users received an email from Dropbox advising them to change their Dropbox passwords, update their personal email passwords, and activate 2FA on their accounts.
Lenovo has stated that its own customers were not affected by this incident and that its investigation into the matter is ongoing.
