Dropbox has begun notifying users after hackers exploited a vulnerability involving Lenovo’s third-party authentication system. The attackers reportedly created Lenovo IDs using only victims’ email addresses and then connected those identities to existing Dropbox accounts, allowing them to gain unauthorized access without obtaining the users’ passwords directly. The incident occurred between August 4 and August 21 and affected approximately 5,000 accounts, according to Dropbox. Most of the compromised accounts did not have two-factor authentication enabled, making them more vulnerable to the authentication flaw.
Dropbox partners with Lenovo as an identity provider, enabling users to sign in to Dropbox with verified Lenovo IDs. The incident demonstrates how a security weakness at a third-party identity provider can place connected accounts at risk, even when the primary service is not breached directly. Affected users should change their Dropbox passwords, review active sessions and connected applications, remove unfamiliar linked accounts, and enable two-factor authentication. Organizations should also monitor third-party login integrations and require stronger authentication controls wherever possible.
Users should also inspect their Dropbox accounts for unfamiliar file activity, unexpected sharing links, deleted content, or changes to security settings. Because cloud-storage accounts may contain personal records, business documents, photographs, and other sensitive information, unauthorized access could create additional privacy and phishing risks. Any suspicious links or account notifications claiming to be from Dropbox should be verified through the official website instead of being opened directly from an email.
The incident is another reminder that third-party authentication can expand an organization’s security exposure. Companies using external identity providers should regularly review account-linking procedures, verify that ownership checks cannot be bypassed with an email address, and quickly revoke access when suspicious activity is detected. Requiring multifactor authentication and monitoring unusual login behavior can help reduce the impact of similar account takeover attempts.