Hacker Breaches Dropbox Accounts Via Lenovo ID System | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

A hacker broke into about 5,000 accounts at cloud storage provider Dropbox by exploiting a login authentication flaw involving PC maker Lenovo. 

Several users reported receiving an email from Dropbox on Monday, warning about the hack. “We are writing to let you know that we’ve observed unauthorized access to your Dropbox account between August 4 and August 21, 2026,” the company wrote.

This Tweet is currently unavailable. It might be loading or has been removed.

A hacker gained access by abusing Lenovo ID, the company’s login and account system. A Lenovo ID can be used to sign up and access Dropbox, but it looks like that system can create a path to hijack an existing Dropbox account if the user’s email address is known. 

In the email, Dropbox explained: “While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address.”

So, rather than viewing the two logins as separate, Dropbox/Lenovo treated them as one since both shared the same email address. “Damn, big security f***** by Dropbox,” wrote one user on the Hacker News forum as the hijacking came to light. “You should never allow linking of an existing account with a new login method without first confirming that the user is able to sign in with an existing method first!” 

The breach is concerning since Dropbox is often used to store sensitive files and documents. However, the scale of the attack is relatively small. Bloomberg reports that the hacker compromised only about 5,000 accounts, none of which were protected by multi-factor authentication. Meanwhile, Lenovo has described the login issue as a “legacy integration” with Dropbox that both companies have worked to address. 

In some cases, Dropbox also appears to tell users, “Our logs show no evidence that your files were viewed or downloaded,” adding, “To secure your account, we promptly expired all sessions logged in through Lenovo IDs. We also severed any link between Lenovo and your Dropbox account, and no one can access your Dropbox account via a Lenovo ID without first entering your Dropbox password.”

Dropbox didn’t immediately respond to a request for comment.