Dropbox breach through Lenovo ID sign-in affects approximately 5,000 accounts
Attackers accessed approximately 5,000 Dropbox accounts without Dropbox two-factor authentication through a Lenovo ID sign-in flaw. Dropbox closed the access route and notified users. Turn on two-factor authentication and contact support if notified.
On dropbox.com, open your profile picture or initials, then Settings → Security, and turn on 2-factor authentication; save the recovery codes. If Dropbox notified you about this incident, contact its support team about your account activity and follow the notice’s instructions. Dropbox made the sign-in changes on its service, so there is no incident-specific app update to install.
What’s happening
Attackers accessed Dropbox accounts between 4 and 21 August 2026 through its Lenovo ID sign-in connection, without knowing the owners’ Dropbox passwords. Victims did not need an existing Lenovo account. Dropbox confirmed approximately 5,000 affected accounts, all without Dropbox two-factor authentication; fewer than one-third had files viewed or downloaded. A notification saying no file access was detected concerned an individual recipient, rather than every affected account. Dropbox revoked all Lenovo-authenticated sessions and added a requirement to enter the Dropbox password when signing in through Lenovo ID. It said it had emailed all affected users, offered support and notified relevant data protection regulators. Lenovo described a legacy integration issue and said its investigation continued. No newer public incident update was found in the search through 3 November 2026.
- What
- Breach
- Affects
- Dropbox accounts accessed through Lenovo ID sign-in
- Fixed in
- Nothing to patch
- Since
- 4 Aug 2026
- Closed
- 3 Sept 2026
Timeline
- Update
Dropbox told ITPro that it had offered affected users support and reported the incident to relevant data protection regulators. The attackers’ identities were not known.
- Update
By this date, Dropbox had expired all Lenovo-authenticated sessions and required the Dropbox password for Lenovo ID sign-ins. Lenovo said the companies had mitigated the legacy integration issue together, but its investigation continued.
- Vendor revised
Dropbox told Decrypt that approximately 5,000 accounts without Dropbox two-factor authentication were affected; fewer than one-third had files viewed or downloaded. It said all affected users had been emailed directly.
- Made public
An affected user publicly shared Dropbox’s notification. It explained that the Lenovo ID sign-in connection had allowed access even though the recipient had never created a Lenovo account.
- UpdateNothing to patch
Unauthorised access to Dropbox accounts began. Dropbox later identified an access window running from 4 to 21 August 2026.
Sources
- Dropbox customer notification: extracts reproduced by 9to5MacDropbox, reproduced by 9to5Mac · 2 Sept 2026
- Dropbox Security Breach: Hackers Access Accounts Through Authentication FlawDecrypt · 1 Sept 2026
- Dropbox accounts breached through Lenovo email verification flawBleepingComputer · 2 Sept 2026
- Everything we know about the Dropbox breach so farITPro · 3 Sept 2026
- How to turn 2-factor authentication on and offDropbox · 25 Nov 2025