A security breach has affected numerous Dropbox accounts between August 4 and August 21, 2026, as communicated directly to affected users via email. The company stated that there is no evidence that files were viewed or downloaded, but unauthorized access occurred through an authentication issue related to the single sign-on (SSO) option with Lenovo IDs.
Lenovo's email verification flaw allowed unauthorized access
According to Dropbox's reconstruction, the root cause was a flaw in Lenovo's email verification process, which allowed unauthorized parties to register a Lenovo ID using the victim's email address. Subsequently, this ID was used to access the Dropbox account associated with that email. Developer Yoni Levy shared a copy of the received email on X, confirming the content of the official communication.
Sponsored Protocol
Dropbox's failure to authenticate amplified the issue
Although Dropbox attributes primary responsibility to Lenovo, the most severe vulnerability lies in Dropbox's failure to verify the user's existing identity before linking the new SSO ID. If Dropbox had required confirmation through the already-in-use login method, the attack would not have succeeded. This negligence has been labeled "egregious" by security experts like The CyberSec Guru, emphasizing that simply verifying the Lenovo ID would have blocked the fraudulent access.
Dropbox fixed the flaw and revoked compromised sessions
The company promptly resolved the issue by fixing the vulnerability and terminating all sessions previously authenticated via Lenovo ID. Users who received the email are advised to change their passwords and monitor account activity. This incident highlights the importance of adopting robust authentication measures, such as two-factor verification, to protect your data. For a broader context on cyberattacks, you can consult the Wikipedia page on phishing.
Sponsored Protocol
In a landscape where cybersecurity is increasingly critical, other services have faced similar challenges. For instance, the rise in chip prices has prompted companies to revise their strategies, but data protection remains a top priority. Users should be vigilant of any suspicious communications and enable all available security measures to reduce the risk of breaches.
