Legacy Lenovo login flaw exposed 5,000 Dropbox accounts

Dropbox says attackers compromised roughly 5,000 accounts between August 4 and August 21 by exploiting a gap in Lenovo's identity verification, not a flaw in Dropbox's own authentication. The bug sat in a now-retired single sign-on integration that let Lenovo customers log into linked Dropbox accounts using a Lenovo ID. Lenovo's signup flow never confirmed that whoever registered a new Lenovo ID actually owned the email address attached to it, so an attacker could create a Lenovo ID under a victim's email and walk straight into that victim's Dropbox account without ever touching a Dropbox password.

Every one of the roughly 5,000 affected accounts had two-factor authentication turned off. According to Cybernews' reporting on the disclosure, Dropbox has said none of the intrusions would have succeeded with 2FA enabled, and files were viewed or downloaded in fewer than a third of the compromised accounts.

Dropbox has expired every session that came in through a Lenovo ID, cut the integration entirely, and now requires a native Dropbox password on every login regardless of how the account was originally linked. Affected users are being told to reset both their Dropbox password and the password on the email account tied to it, since the same email-trust gap that let an attacker in could resurface anywhere a similar SSO shortcut exists.

For anyone wiring up a third-party login option, whether that's Google, GitHub, or a vendor-specific SSO like this one, the lesson isn't really about Lenovo. Federated login is only as strong as the weakest party's email verification, and a legacy integration nobody's actively maintaining is exactly where that weakness survives long enough to matter. Auditing which SSO providers are still linked to production accounts, and turning off the ones nobody remembers adding, costs less than the incident response that follows one going bad.