Home / Technology / Lenovo Bug Unlocks 5,000 Dropbox Accounts
Lenovo Bug Unlocks 5,000 Dropbox Accounts
2 Sep
Summary
- Hackers exploited Lenovo's flawed email verification to access around 5,000 Dropbox accounts.
- Attackers created Lenovo IDs with victims' emails, bypassing logins due to a verification flaw.
- The vulnerability, active from August 4-21, impacted accounts mostly lacking 2FA.
Around 5,000 Dropbox user accounts were compromised due to a vulnerability in Lenovo's ID verification process. Hackers exploited an issue with Lenovo's email verification system between August 4 and 21, 2026. They created Lenovo IDs using victims' email addresses, bypassing security to access associated Dropbox accounts. This incident primarily impacted accounts lacking two-factor authentication (2FA).
Dropbox has since taken steps to address the vulnerability. This included expiring all sessions logged in through Lenovo IDs and terminating the integration. Users are now required to re-enter their Dropbox password for Lenovo ID logins. The company strongly advises users to change their passwords and enable 2FA for both Dropbox and their email accounts.
