Dropbox breach hits ~5,000 accounts via trusted Lenovo ID verification flaw
jedisct1 · x · 2026-09-03
Dropbox disclosed that roughly 5,000 accounts were accessed without authorization between August 4 and 21, with files viewed or downloaded in fewer than a third of them.
The attack vector was strikingly simple: registering a Lenovo ID with someone else's email address was enough — Dropbox trusted Lenovo's verification and handed over a session. Dropbox has terminated every Lenovo ID session and notified regulators.
Related event: Dropbox Breach Exposes ~5,000 Accounts via Lenovo ID Flaw(3 posts)→
More from Safety
- Dormant poisoning can turn safe LLM agents dangerous after benign fine-tuning; LookAhead defense proposed — mohitban47 · 2026-10-21
- GitHub HQ Hosts Open Source AI + Policy Talk with Mozilla Co-founder Mitchell Baker — kevinsxu · 2026-10-21
- Researcher Finds Two Windows 0-Days, First in 76 Minutes with a Frontier Model — moyix · 2026-10-21
- Stanford's Noah Goodman shares interactive AI safety concept map — stanfordnlp · 2026-10-21
- AI agents are overwhelming Gmail's spam filter, researcher warns — LuizaJarovsky · 2026-10-21
- AI safety researcher Sören Mindermann moves to Tsinghua, co-founds Beijing AI Safety Hub — dhadfieldmenell · 2026-10-21