Dropbox Says 5,000 Accounts Were Compromised Through Lenovo ID Authentication Flaw

Dropbox disclosed that about 5,000 user accounts were compromised in August 2026 after attackers abused a Lenovo ID sign-in integration: attackers registered Lenovo IDs using victims' email addresses (due to Lenovo's email verification flaw) and then accessed Dropbox accounts tied to those emails without needing Dropbox passwords. The incident was an account-takeover via federated authentication trust, primarily affecting accounts without Dropbox two-factor authentication; Dropbox terminated Lenovo-ID sessions, removed the association, and required passwords for Lenovo-ID logins while recommending password changes and enabling two-step verification.