Dropbox disclosed that approximately 5,000 user accounts were compromised between August 4 and August 21, 2026, after attackers exploited a flaw in Lenovo’s email verification and federated authentication process. The vulnerability allowed attackers to register fraudulent Lenovo IDs using victims’ email addresses without verifying control of those inboxes. Since Dropbox’s legacy Lenovo integration trusted Lenovo’s identity assertion and automatically associated the verified email with an existing Dropbox account, attackers could obtain authenticated sessions and access accounts without knowing or stealing victims’ Dropbox passwords, including accounts belonging to users who had never created a Lenovo ID. Most affected accounts did not have two-factor authentication enabled, and Dropbox found evidence that files were viewed or downloaded from roughly one-third of the compromised accounts, potentially exposing sensitive documents stored within them. Users began reporting suspicious sign-in alerts, unsolicited Lenovo verification codes, and unexpected “Continue with SSO” options in mid-August, helping expose the activity. Lenovo said its own customers were not affected and attributed the issue to a legacy integration with Dropbox. In response, Dropbox and Lenovo patched the vulnerability, while Dropbox expired all sessions authenticated through Lenovo IDs, severed affected Lenovo-Dropbox account links, and changed the authentication process so users must now enter their Dropbox password before accessing an account through Lenovo ID. Dropbox also advised affected users to change their Dropbox and email passwords and enable two-step verification. CTIX analysts urge affected users to follow the Dropbox guidance to ensure they are not compromised from this flaw in the future.