The breach occurred because of a vulnerability in Lenovo's email verification algorithms. Attackers registered fraudulent Lenovo IDs using the email addresses of Dropbox users, which allowed them to bypass password requirements and gain direct access to the same accounts in Dropbox.
According to Dropbox, the unauthorized access took place between August 4 and August 21. Some users reported receiving notifications about suspicious logins approximately two weeks prior to the public disclosure.
Reuters reports that approximately 5,000 accounts were compromised, with attackers downloading data from some of them. Lenovo stated that the issue stemmed from an outdated integration between Lenovo ID and Dropbox, and confirmed that active Lenovo account holders were not affected.
In response, Dropbox has invalidated all sessions authenticated via Lenovo ID and now requires a password when attempting to use Lenovo ID for authentication.
