{"id":"dropbox-lenovo-account-breach-aug-2026","category":"breach","status":"closed","title":"Dropbox breach through Lenovo ID sign-in affects approximately 5,000 accounts","tldr":"Attackers accessed approximately 5,000 Dropbox accounts without Dropbox two-factor authentication through a Lenovo ID sign-in flaw. Dropbox closed the access route and notified users. Turn on two-factor authentication and contact support if notified.","summary":"Attackers accessed Dropbox accounts between 4 and 21 August 2026 through its Lenovo ID sign-in connection, without knowing the owners’ Dropbox passwords. Victims did not need an existing Lenovo account. Dropbox confirmed approximately 5,000 affected accounts, all without Dropbox two-factor authentication; fewer than one-third had files viewed or downloaded. A notification saying no file access was detected concerned an individual recipient, rather than every affected account. Dropbox revoked all Lenovo-authenticated sessions and added a requirement to enter the Dropbox password when signing in through Lenovo ID. It said it had emailed all affected users, offered support and notified relevant data protection regulators. Lenovo described a legacy integration issue and said its investigation continued. No newer public incident update was found in the search through 3 November 2026.","action":"On dropbox.com, open your profile picture or initials, then Settings → Security, and turn on 2-factor authentication; save the recovery codes. If Dropbox notified you about this incident, contact its support team about your account activity and follow the notice’s instructions. Dropbox made the sign-in changes on its service, so there is no incident-specific app update to install.","product":"Dropbox accounts accessed through Lenovo ID sign-in","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["dropbox","lenovo","data-breach","account-takeover","cloud-storage"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Dropbox customer notification: extracts reproduced by 9to5Mac","url":"https://9to5mac.com/2026/09/02/dropbox-login-breach-seemingly-caused-by-egregious-authentication-failure/","by":"Dropbox, reproduced by 9to5Mac","date":"2026-09-02"},{"kind":"news","title":"Dropbox Security Breach: Hackers Access Accounts Through Authentication Flaw","url":"https://decrypt.co/377099/hwvs6c8n2v5n","by":"Decrypt","date":"2026-09-01"},{"kind":"news","title":"Dropbox accounts breached through Lenovo email verification flaw","url":"https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/","by":"BleepingComputer","date":"2026-09-02"},{"kind":"news","title":"Everything we know about the Dropbox breach so far","url":"https://www.itpro.com/security/data-breaches/everything-we-know-about-the-dropbox-breach-so-far","by":"ITPro","date":"2026-09-03"},{"kind":"advisory","title":"How to turn 2-factor authentication on and off","url":"https://help.dropbox.com/account-access/enable-2-factor-authentication","by":"Dropbox","date":"2025-11-25"}],"started":"2026-08-04","closed":"2026-09-03","created":"2026-11-03T20:53:55.206Z","updated":"2026-11-03T20:53:55.206Z","cve_notes":[],"timeline":[{"at":"2026-09-03","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Dropbox told ITPro that it had offered affected users support and reported the incident to relevant data protection regulators. The attackers’ identities were not known.","url":"https://www.itpro.com/security/data-breaches/everything-we-know-about-the-dropbox-breach-so-far","by":"ITPro","patch":null},{"at":"2026-09-02","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"By this date, Dropbox had expired all Lenovo-authenticated sessions and required the Dropbox password for Lenovo ID sign-ins. Lenovo said the companies had mitigated the legacy integration issue together, but its investigation continued.","url":"https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/","by":"BleepingComputer","patch":null},{"at":"2026-09-01","added":"2026-11-03T20:51:54.186Z","kind":"vendor-revised","text":"Dropbox told Decrypt that approximately 5,000 accounts without Dropbox two-factor authentication were affected; fewer than one-third had files viewed or downloaded. It said all affected users had been emailed directly.","url":"https://decrypt.co/377099/hwvs6c8n2v5n","by":"Decrypt","patch":null},{"at":"2026-08-31","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"An affected user publicly shared Dropbox’s notification. It explained that the Lenovo ID sign-in connection had allowed access even though the recipient had never created a Lenovo account.","url":"https://decrypt.co/377099/hwvs6c8n2v5n","by":"Decrypt","patch":null},{"at":"2026-08-04","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Unauthorised access to Dropbox accounts began. Dropbox later identified an access window running from 4 to 21 August 2026.","url":"https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/","by":"BleepingComputer","patch":"na"}],"url":"https://hard.fyi/live/dropbox-lenovo-account-breach-aug-2026/","json":"https://hard.fyi/api/live?id=dropbox-lenovo-account-breach-aug-2026"}