Dropbox Accounts Breached via Lenovo SSO Flaw, ~5,000 Users Affected

Dropbox is warning users that an unauthorized party accessed roughly 5,000 accounts between August 4 and August 21, 2026, by exploiting a flaw in Lenovo’s email verification system. Dropbox integrates Lenovo Identity Provider Services as part of its authentication options, allowing users to sign in with a verified Lenovo ID — similar to how “Continue with Google” or “Continue with Apple” buttons work. The vulnerability: Lenovo’s verification process could be abused to register a new Lenovo ID using someone else’s email address without the real owner confirming it. Once the attacker had a Lenovo ID tied to a target’s email, Dropbox trusted the assertion and unlocked the matching account — no Dropbox password required. Affected users reported seeing a “Continue with SSO” button appear on the Dropbox login page for their email even though they had never created a Lenovo account, which was the first visible signal something was wrong.

Dropbox and Lenovo have mitigated the issue by severing the legacy integration that made the attack possible. Dropbox expired all active sessions authenticated via Lenovo IDs and added a new requirement: users must enter their Dropbox account password whenever they attempt to use Lenovo ID authentication going forward. Lenovo stated that its own customers were not affected. The attacker did view and download content from some of the accessed accounts, according to Reuters. If you use Dropbox, check whether you received a breach notification from the company in the past few weeks. Changing your Dropbox password and enabling two-step verification are the recommended steps regardless.

How to check if you’re affected

Affected products include any Dropbox account — Free, Plus, or Business — whose email address was targeted. Dropbox has already expired compromised sessions, but you should still verify your account:

1. Log in at dropbox.com and go to Settings → Security → Devices and sessions to review active sessions.
2. If you see unrecognized devices or login locations from August 4–21, your account was likely accessed.
3. Change your Dropbox password and enable two-step verification under Settings → Security → Two-step verification.
4. Check whether any files were shared, modified, or downloaded during that window under Activity in your account.

Sources

• BleepingComputer: Dropbox accounts breached through Lenovo email verification flaw