Breaches and incidentsBriefReported by a reputable outlet, citing the company
Dropbox: Lenovo ID email-verification flaw let attackers log into about 5,000 Dropbox accounts without passwords
Dropbox notified users that an unauthorized party accessed their accounts between 4 and 21 Aug 2026 because of “an issue with Lenovo’s email verification...
- Disclosed
What happened
- Dropbox notified users that an unauthorized party accessed their accounts between 4 and 21 Aug 2026 because of “an issue with Lenovo’s email verification process”; about 5,000 accounts (Reuters). The attacker viewed and downloaded some users’ files.
- Root cause: Lenovo ID let an attacker register an ID with a victim’s email address without proving ownership; Dropbox’s identity linking trusted Lenovo’s verification and linked the Lenovo ID to the matching Dropbox account without asking for the existing login. Lenovo called it a “legacy integration.”
- No attacker named.
- Dropbox expired all Lenovo-ID sessions and now requires the Dropbox password when using Lenovo ID.
Sources
- https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/
- https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-september-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.