Dropbox hit by security incident linked to Lenovo verification vulnerability

Cloud storage provider Dropbox has disclosed a significant cybersecurity incident after threat actors exploited a vulnerability in Lenovo’s email verification process.

 

Dropbox is a widely used cloud storage and file synchronisation platform that enables users to securely store, manage, share, and access their files across multiple devices. Its integration with Lenovo is linked to Lenovo Identity Provider Services, which are designed to support user authentication and identity verification. Through this connection, users can access their Dropbox accounts by using verified Lenovo identities, providing a streamlined sign-in experience without requiring separate authentication steps each time.

 

Recently, Dropbox has started notifying its customers of a data security incident where threat actors accessed certain Dropbox accounts between August 4 and August 21, 2026. The company launched an investigation to determine the nature and scope of the incident. 

 

 

 

“Dropbox partners with Lenovo as an identity provider so that users can log in to their Dropbox accounts using verified Lenovo IDs. While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo’s email verification process allowed an unauthorised party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address,” Dropbox said.

 

The company added that its logs showed no evidence that customer files had been accessed or downloaded, and it promptly terminated all sessions logged in through Lenovo IDs. The company also removed the connection between Lenovo and Dropbox accounts, meaning that no one can access a Dropbox account using a Lenovo ID without first entering the Dropbox password.

 

In a statement shared with BleepingComputer, a Lenovo spokesperson said that the issue originated from an outdated integration between Lenovo ID and Dropbox, which could potentially be exploited to improperly authenticate certain Dropbox accounts. 

 

“Upon identifying the issue, Dropbox and Lenovo worked collaboratively to promptly mitigate the risk,” the spokesperson added.