Multiple Dropbox users have been emailed by the cloud storage company to advise them that a security breach saw unauthorised access to their account. Update: the company has said that about 5,000 accounts were compromised, with files downloaded from around 1,500 of them.
The root cause appears to be a lack of authentication by Dropbox when attackers created a single sign-on option through a third-party company …
Developer Yoni Levy posted a copy of the email he received on X.
We are writing to let you know that we’ve observed unauthorized access to your Dropbox account between August 4 and August 21, 2026. While our logs show no evidence that your files were viewed or downloaded, we want to share with you what happened, what we are doing about it, and what additional steps you can take.
Other Dropbox users reported receiving the same email in which the company said it resulted from a problem with a single sign-on (SSO) option using Lenovo IDs.
Dropbox partners with Lenovo as an identity provider so that users can log in to their Dropbox accounts using verified Lenovo IDs. While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address.
However, while Dropbox claims the flaw was in Lenovo’s email verification process, the bigger issue appears to be that Dropbox itself did not require users to use their existing login to verify the new SSO, as The CyberSec Guru reports.
The company has now fixed the flaw and expired all sessions previously ‘authenticated’ through a Lenovo ID.
If you don’t already have two-factor authentication enabled for Dropbox, it is highly recommended to change this immediately.
FTC: We use income earning auto affiliate links. More.
Check out 9to5Mac on YouTube for more Apple news:
Lead the curve on tomorrow’s iOS and Mac app h…
Ben Lovejoy is a British technology writer and EU Editor for 9to5Mac. He’s known for his op-eds and diary pieces, exploring his experience of Apple products over time, for a more rounded review. He also writes fiction, with two technothriller novels, a couple of SF shorts and a rom-com!
