Dropbox accounts breached through Lenovo email verification flaw

2026-09-03

Attackers accessed Dropbox accounts by exploiting a flaw in Lenovo's email verification process to create fraudulent Lenovo IDs tied to victims' email addresses, allowing them to authenticate without the Dropbox password. Roughly 5,000 accounts were reportedly affected, making the incident a useful reminder that federated identity risk can extend well beyond your primary IdP.