Hackers got into roughly 5,000 Dropbox accounts last month, according to the company and records reviewed by Bloomberg News. On Monday, certain users were notified that unauthorized access had occurred between Aug. 4 and Aug. 21. The messages varied: some people were told their files were viewed and downloaded, whereas others were informed there was no evidence of that. Dropbox said it locked down the accounts once it learned of the issue and has alerted regulators and those affected.
The compromised accounts did not have multifactor authentication turned on, a Dropbox spokesperson said. According to notification emails, the entry point was Lenovo ID - the username and password that unlock Lenovo products and services. A problem with Lenovo's email verification process meant attackers could create Lenovo IDs tied to Dropbox users' email addresses, even when those users had never opened a Lenovo ID. Since verified Lenovo IDs can be used to sign in to Dropbox, the attackers then used those credentials to get in.
In an email statement, Lenovo said that a "legacy integration" between Lenovo ID and Dropbox "could be used to improperly authenticate certain Dropbox accounts," and that the companies worked together to "mitigate the risk." Lenovo added its customers weren't affected and that an investigation is ongoing. On Tuesday, Dropbox's stock fell as much as 6.6% during after-hours trading. The company said it does not anticipate the incident will significantly affect its business.
When headlines feel confusing, a steady plan can help you stay on course, so download the free Always Be Buying E-Book
Security lapses can rattle confidence fast - that after-hours drop tells the story. Here, the company says the fallout should be limited, it worked with Lenovo to curb the risk, and it's notified regulators and users. For consumers and investors alike, the takeaway is simple: integrations and login shortcuts can be convenient, but they also widen the attack surface when something upstream breaks.