Dropbox says 5,000 accounts were breached through a Lenovo ID login flaw

Dropbox has told around 5,000 users that an unauthorised party accessed their accounts between 4 and 21 August 2026, after attackers abused an integration that allowed people to sign in to Dropbox using a Lenovo ID.

Dropbox confirmed the scale of the incident to Reuters, as reported by The Register, and said attackers viewed or downloaded files from fewer than a third of the affected accounts. Notification emails began reaching users at the start of September.

How the access worked

Dropbox uses Lenovo Identity Provider Services as part of its authentication infrastructure, which lets people log in to a Dropbox account using a verified Lenovo ID.

According to the notification sent to affected users, a flaw in Lenovo's email verification process allowed someone to register a Lenovo ID using an email address they did not control. Presenting that Lenovo ID to Dropbox was then enough to reach the Dropbox account registered under the same address, with no password required.

BleepingComputer reported that some of the people who received notifications had never created a Lenovo account at all. The rogue identity was registered for them, keyed only to their email address.

The step that made this work was on the Dropbox side. Dropbox's identity-linking process accepted Lenovo's assertion that the party held the email address, without requiring the account holder to confirm the link through their existing Dropbox login. The Register noted that Dropbox has not explained why the integration was permitted to grant access without a Dropbox password.

Dropbox told Reuters that none of the affected accounts had Dropbox two-factor authentication enabled.

What the companies said

Lenovo told BleepingComputer that the problem related to a legacy integration between Lenovo ID and Dropbox that could be used to authenticate certain Dropbox accounts improperly. A Lenovo spokesperson said the two companies worked together to mitigate the risk once it was identified, that the investigation is continuing, and that Lenovo determined its own customers were not affected.

Dropbox said it expired all sessions that had been logged in through Lenovo IDs and severed the link between affected accounts and Lenovo. It has since added a requirement that users enter their Dropbox password when signing in through a Lenovo ID. Affected users were advised to change their Dropbox and personal email passwords and to turn on two-factor authentication.

The visible warning sign

One user described noticing, before any notification arrived, that the Dropbox login page had begun offering a single sign-on option for their email address despite them never having created a Lenovo ID. That user had already changed their password and enabled two-factor authentication after receiving alerts about suspicious sign-ins.

The detail is worth noting because it was observable from the outside. A login page suddenly offering a federated sign-in option for an account that never enrolled in one is a visible symptom of an identity link being created without the account holder's involvement.

Jameson Lopp, co-founder of the Bitcoin security firm Casa, said attackers reached a single file in his account, which had been encrypted locally before it was uploaded.

What this points to

The compromise did not involve stolen passwords, phishing, or any failure in Dropbox's storage layer. It came from the trust relationship between an application and an external identity provider, and specifically from what that application accepted as proof that a new identity belonged to an existing user.

For organisations running similar integrations, the checkable question is narrow: when a new federated identity is presented for an email address that already has an account, does the system link the two automatically, or does it require the account holder to authenticate through their existing method first? On the evidence of this incident, the difference between those two designs was the difference between an account being reachable and not.

Two-factor authentication also held. Dropbox's position is that affected accounts were those without it enabled, which places the control ahead of the authentication flaw that preceded it.