Multiple Dropbox users received emails from the cloud storage provider informing them that a security breach had granted unauthorized access to their accounts.
The investigation points to a critical authentication lapse on Dropbox’s part when attackers leveraged a single‑sign‑on (SSO) option provided by a third‑party vendor.
Developer Yoni Levy shared a copy of the notification email he received on the social platform X.
In the notice, Dropbox said it observed unauthorized access to affected accounts between August 4 and August 21, 2026. While its logs show no indication that files were viewed or downloaded, the company outlined what happened, the steps it is taking, and additional actions users can perform.
Other users reported receiving identical emails. Dropbox explained that the incident stemmed from a problem with its SSO feature that relies on Lenovo IDs.
Dropbox works with Lenovo as an identity provider, allowing users to sign into Dropbox using verified Lenovo credentials. Even if a user does not have a Lenovo ID, the investigation revealed that a flaw in Lenovo’s email‑verification process let an intruder register a Lenovo ID with a victim’s email address. That rogue Lenovo ID was then used to log into the Dropbox account tied to the same email.
We are writing to let you know that we’ve observed unauthorized access to your Dropbox account between August 4 and August 21, 2026. While our logs show no evidence that your files were viewed or downloaded, we want to share with you what happened, what we are doing about it, and what additional steps you can take.
However, Dropbox’s own checks appear insufficient. According to The CyberSec Guru, the platform did not require users to confirm the new SSO with their existing login, which would have caught the unauthorized link.
– Reconnaissance: The attacker gathered target email addresses from breach databases, LinkedIn, customer lists—essentially public data.
– Rogue IdP enrollment: The attacker created a Lenovo ID under victim@example.com. No inbox access was needed because Lenovo’s verification could be bypassed or was missing. The display name was disposable; one victim who reclaimed the account saw “John Madden,” a clear sign of bulk, low‑effort sign‑ups.
Dropbox partners with Lenovo as an identity provider so that users can log in to their Dropbox accounts using verified Lenovo IDs. While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address.
– Federated sign‑in: The attacker clicked “Continue with Lenovo” on Dropbox. Lenovo’s authorization server issued a token whose email claim matched the victim’s Dropbox account.
– Implicit account linking: Dropbox resolved the email claim to the existing account and generated a session without prompting for a password, additional verification, or consent to link the new identity. From Dropbox’s view, a trusted identity provider had already validated the address.
Digitio’s Take
While Lenovo’s email‑verification process was clearly weak, Dropbox could have prevented the breach by authenticating the linked Lenovo ID before allowing sign‑in. The failure to do so constitutes a serious security oversight.
The company has now patched the vulnerability and invalidated every session that had been authenticated via a Lenovo ID.
Photo by Shubham Dhage on Unsplash