Everything we know about the Dropbox breach so far

Hackers have breached cloud storage provider Dropbox via a flaw in Lenovo’s email verification process.

Around 5,000 accounts are believed to have been compromised during the first three weeks of August, with files viewed or downloaded from around 1,500 of these. It's not known who carried out the attack.

The breach arose through the single sign-on (SSO) option using Lenovo IDs. Dropbox partners with Lenovo as an identity provider, allowing users to log in to their Dropbox accounts using verified Lenovo IDs.

However, the process lacked enforced two-factor authentication (2FA), meaning that an attacker could gain full access without needing a password. Even users without a pre-existing Lenovo ID were vulnerable.

The company has now alerted users.

"While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address," the company said.

Justin Beals, CEO and founder of Strike Graph, said the incident appears to have derived from a trusted legacy integration between the two firms.

"This is the same failure mode we keep seeing across every major vendor breach this year. Organizations assess the vendors they contract with directly, then treat every integration that vendor maintains as inherited trust. Nobody re-verifies the third-party connections a trusted platform has already built," he said.

"Traditional third-party risk management approaches have true positive detection rates below 30%, and a legacy authentication bridge between two major platforms is exactly the kind of dependency that a point-in-time questionnaire was never built to catch."

Dropbox breach could've been avoided

Dropbox has now closed the loophole by expiring all sessions authenticated through Lenovo IDs, cutting any link between Lenovo, and adding the requirement for users to enter their Dropbox account password when attempting to use Lenovo ID authentication.

A spokesperson for Dropbox told ITPro the company reacted swiftly to the incident and has informed affected users.

“We emailed users we know were impacted, offered them support, and reported this event to relevant data protection regulators," they said.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, suggested that some users only have themselves to blame for not implementing multi-factor authentication (MFA).

“Every single one of the compromised accounts lacked multi-factor authentication. In 2026, for cloud storage accounts holding data, that’s an indefensible gap, and it’s one that users could have closed themselves regardless of what Lenovo or Dropbox did or didn’t do with their legacy integration," he said.

Organizations should periodically audit what third-party services have authentication access to their accounts, he said.

"OAuth grants, SSO connections, and third-party login integrations accumulate silently and rarely get removed when the relationship that created them ends,” Patel added.

Dropbox has been hit before, with a 2012 breach that affected around two-thirds of the company's user base. Four years later, more than 68 million customer usernames and passwords were leaked.

On that occasion, accounts were compromised through password reuse, Dropbox said.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.