Hackers Breach 5,000 Dropbox Accounts by Exploiting Lenovo Email Verification Flaw

More than 5,000 Dropbox users found their cloud storage compromised after attackers leveraged a weakness in Lenovo's email‑verification process to gain unauthorized access.

According to the investigation, the threat actors created counterfeit Lenovo IDs using the victims' email addresses. Lenovo’s system failed to verify ownership of those addresses, allowing the fake accounts to be linked to existing Dropbox credentials without needing a password.

The breach was amplified by the fact that many affected Dropbox users had not enabled two‑factor authentication (2FA). Without that extra security layer, the malicious logins succeeded simply by matching an email address to a Dropbox account, bypassing the usual password check.

Dropbox responded by immediately disabling the ability to log in via Lenovo IDs, terminating active sessions tied to the compromised accounts, and prompting users to change passwords. The company also urged all customers to activate 2FA to mitigate future attacks.

The incident highlights the risks of relying on third‑party identity providers that do not enforce strict verification standards. As more services adopt federated login options, a single flaw in one provider can cascade across multiple platforms, exposing large numbers of users.

Security experts recommend that anyone who uses Dropbox—or similar services—review their account activity, update passwords to strong, unique strings, and enable 2FA wherever possible. Monitoring for unexpected file changes or shared links can also help spot unauthorized access early.

Law enforcement and cybersecurity investigators are reportedly examining the breach to determine the scope of the attackers' motives and whether additional data was exfiltrated. The episode may prompt both Lenovo and other identity providers to tighten verification procedures and could lead to broader industry discussions about safeguarding federated authentication flows.