Dropbox says about 5,000 accounts compromised in August hack

Dropbox disclosed on Tuesday that approximately 5,000 user accounts were compromised in a security breach that occurred last month. Hackers were able to view and download content stored on the cloud-storage platform. Some affected users received notification emails from Dropbox on Monday, informing them that their accounts had been accessed without authorization between August 4 and August 21. The company confirmed the hack after Bloomberg News reported on the incident earlier in the day.

Hackers successfully accessed files in less than a third of the compromised accounts. Dropbox stated that the unauthorized access was linked to a Lenovo ID that did not have two-factor authentication enabled. In response, the company terminated all sessions authenticated through the Lenovo ID. To prevent future occurrences, Dropbox has removed any connections between Lenovo IDs and Dropbox accounts and implemented new systems requiring users to enter their Dropbox password before accessing an account through Lenovo.

Dropbox informed data protection regulators about the incident. Lenovo, which had a legacy integration between its Lenovo ID and Dropbox, identified the vulnerability that allowed improper authentication of certain Dropbox accounts. The company reassured its customers that they were not affected by the breach, and an investigation into the matter is currently underway.