Dropbox accounts compromised via Lenovo ID authentication flaw

Unauthorized parties accessed multiple Dropbox accounts through an authentication flaw related to Lenovo ID. The issue involved Dropbox's handling of single sign-on (SSO) with Lenovo IDs, allowing unauthorized registration of Lenovo IDs using other people's email addresses. This enabled access to Dropbox accounts linked to those addresses. The unauthorized access occurred between August 4 and August 21, 2026, although Dropbox found no evidence of files being viewed or downloaded. Approximately 5000 accounts were impacted, with less than a third having files accessed. Affected users were notified directly, and those who did not receive an email were not impacted. The attack did not require the victim's Dropbox password or email access, as affected accounts lacked Dropbox two-factor authentication. This incident follows other security concerns on major online platforms.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.