Dropbox accounts breached through Lenovo email verification flaw

Dropbox disclosed that attackers abused a flaw in Lenovo's email verification to register fake Lenovo IDs and log into linked Dropbox accounts without passwords between August 4–21, affecting about 5,000 accounts; Dropbox and Lenovo mitigated the issue by expiring Lenovo-authenticated sessions and requiring Dropbox passwords for Lenovo ID logins while investigations continue.