Legacy Lenovo login opens 5,000 Dropbox accounts to attackers

Dropbox has alerted approximately 5,000 users that their accounts were compromised due to an exploitation of a legacy Lenovo login integration. In an email to those affected, the cloud storage company claimed that attackers took advantage of an integration that enabled users to access Dropbox using Lenovo IDs. Dropbox attributed the issue to an email verification process problem by Lenovo, which allowed attackers to register Lenovo IDs using Dropbox users' email addresses, consequently gaining access to the respective storage accounts.

They did not clarify why access was provided without necessitating the user to input a Dropbox password.

The breach persisted from August 4 to 21. Dropbox informed Bloomberg that attackers accessed less than a third of the affected users' files. Jameson Lopp, co-founder of Bitcoin security company Casa, stated that attackers tried to access only one of his files, named 'IMPORTANT.rtf,' which was encrypted locally prior to being uploaded to Dropbox.

At times, it's advantageous to possess expertise in certain areas. Dropbox confirmed the extent of the attack to Reuters and disclosed that none of the affected accounts had two-factor authentication (2FA) activated. Upon discovering the breach, Dropbox immediately terminated all sessions logged in through Lenovo IDs and severed any connection between the affected accounts and Lenovo.

In its email, the company recommended affected users to change their Dropbox and personal email passwords and enable 2FA. Lenovo stated to Reuters that its customers remained unharmed, and its investigation was ongoing. The Register sought further details from both Dropbox and Lenovo.