Attacker Accessed Dropbox Accounts Through a Lenovo ID Issue
Dropbox warned some users about unauthorized access to their accounts. The attacker reportedly exploited Lenovo ID email verification to sign in without knowing the Dropbox password.
Lenovo ID integration with Dropbox became a path to unauthorized access to some Dropbox accounts. According to alerts sent by the service to affected users, the attacker exploited an issue with Lenovo ID email verification. The access reportedly took place from August 4 to 21, 2026, while the alerts were sent to users on September 1 and 2.
The mechanism reportedly allowed the attacker to register a Lenovo ID using the victim’s email address and then use that identity to sign in to the corresponding Dropbox account. The affected accounts could therefore be accessed without knowing their Dropbox password.
Lenovo ID integration and the method of exploitation
According to the content of Dropbox’s customer notifications, the issue was related to linking an external Lenovo ID account with an existing Dropbox account, where the email address played a key role.
In a statement to BleepingComputer, Lenovo described the issue as an older integration between Lenovo ID and Dropbox. The company also said it had mitigated the risk together with Dropbox. However, a full technical description of the email-verification flaw and the precise division of responsibility between the companies has not been publicly disclosed.
According to the available alerts, Dropbox invalidated sessions verified through Lenovo ID. It also added a requirement to enter the Dropbox password for this sign-in method. This change is intended to prevent the external identity alone, with the same email address, from being sufficient to access an existing account.
Unknown scope and file activity
The number of affected accounts has not been publicly confirmed. In the cited alerts, Dropbox told users that its logs showed no evidence that the attacker viewed or downloaded files. However, this is not independent confirmation of what occurred in every individual case.
It is likewise not publicly documented whether the attacker modified files or worked with their metadata in some accounts. No initial security notice from Dropbox or Lenovo has yet been published regarding the incident; the available confirmations come from customer alerts and Lenovo’s statement to the media.
Why the case matters
Dropbox is used to store personal and business data, making the security of login links with external identities important. This case highlights the risk of federated sign-in when a service links an external identity to an existing account based solely on an email address.
For users who received an alert, it is relevant that Dropbox invalidated the affected sessions and modified the sign-in flow through Lenovo ID. Publicly available information does not yet indicate whether the Lenovo ID connection with Dropbox will be permanently removed or whether the companies will announce further measures.
Further information could come from a public security notice by both companies, confirmation of the number of affected accounts, and any clarification of the scope of access to the data.
Sources
- BleepingComputer – Cites Dropbox’s notification to affected users, gives the access interval, describes the mitigations taken, and includes Lenovo’s statement about the older integration.
- 9to5Mac – Independently reproduces the content of Dropbox’s customer notification, including the description of the Lenovo ID exploitation and the claim that there was no evidence of files being downloaded or viewed.
Verified and updated: 09/02/2026 17:09
