Lenovo Email Verification Bug Enables Hackers to Compromise Over 5,000 Dropbox Accounts

Over 5,000 Dropbox customers had their cloud storage breached after threat actors exploited a flaw in Lenovo’s email‑verification system to obtain illicit entry.

The probe revealed that the attackers forged Lenovo IDs by employing the victims’ email addresses. Because Lenovo’s platform did not confirm ownership of those emails, the bogus IDs could be attached to the victims’ Dropbox accounts without requiring a password.

The incident was worsened by the fact that a large portion of the compromised Dropbox users had not activated two‑factor authentication (2FA). Lacking this additional safeguard, the attackers were able to log in merely by aligning an email address with a Dropbox profile, sidestepping the normal password requirement.

In response, Dropbox promptly disabled Lenovo‑ID logins, ended any active sessions linked to the affected accounts, and instructed users to reset their passwords. The firm also recommended that every customer enable 2FA to reduce the risk of similar attacks.

This breach underscores the danger of depending on third‑party identity providers that lack rigorous verification protocols. As federated login options become more common, a vulnerability in one provider can ripple through numerous services, putting many users at risk.

Experts in security advise all Dropbox (or comparable) users to audit their account activity, replace passwords with strong, unique ones, and enable 2FA wherever feasible. Keeping an eye on unexpected file modifications or newly shared links can also aid in detecting unauthorized access promptly.

Law‑enforcement agencies and cyber‑security investigators are said to be reviewing the incident to gauge the attackers’ objectives and to find out if further data was stolen. The episode could push Lenovo and other identity providers to reinforce their verification processes and may spark wider industry dialogue on protecting federated authentication pathways.