Dropbox Confirms ~5,000 Accounts Accessed via Lenovo ID SSO Flaw in August 2026

Multiple credible reports confirm that Dropbox notified approximately 5,000 users of unauthorized access to their accounts between August 4 and August 21, 2026. Attackers exploited a flaw in Lenovo's email verification process to register fraudulent Lenovo IDs using victims' email addresses, then leveraged a legacy single sign-on (SSO) integration between Lenovo ID and Dropbox to authenticate without the Dropbox password or email access. Most affected accounts lacked Dropbox two-factor authentication. Dropbox and Lenovo collaborated to mitigate the issue by expiring Lenovo-authenticated sessions, severing the legacy links, and requiring Dropbox passwords for future Lenovo ID logins. Files were viewed or downloaded in fewer than one-third of cases. The incident has been reported to regulators, and Lenovo stated its own customers were unaffected. This highlights risks in federated identity systems where email verification assumptions can be bypassed.