// 9TO5MAC — MOBILE & WEB
Dropbox breach seemingly caused by egregious authentication failure
Multiple Dropbox users have been emailed by the cloud storage company to advise them that a security breach saw unauthorised access to their account.
The root cause appears to be a lack of authentication by Dropbox when attackers created a single sign-on option through a third-party company …
Developer Yoni Levy posted a copy of the email he received on X.
We are writing to let you know that we’ve observed unauthorized access to your Dropbox account between August 4 and August 21, 2026. While our logs show no evidence that your files were viewed or downloaded, we want to share with you what happened, what we are doing about it, and what additional steps you can take.
Other Dropbox users reported receiving the same email in which the company said it resulted from a problem with a single sign-on (SSO) option using Lenovo IDs.
Dropbox partners with Lenovo as an identity provider so that users can log in to their Dropbox accounts using verified Lenovo IDs. While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address.
However, while Dropbox claims the flaw was in Lenovo’s email verification process, the bigger issue appears to be that Dropbox itself did not require users to use their existing login to verify the new SSO, as The CyberSec Guru reports.
While there was certainly a failure to verify email addresses at the Lenovo end, it would not have done any harm if Dropbox had authenticated the linked ID before it could be used to sign in. Failing to do so is an egregious fault.
The company has now fixed the flaw and expired all sessions previously ‘authenticated’ through a Lenovo ID.
FTC: We use income earning auto affiliate links. More.