Dropbox breach hits ~5,000 accounts via trusted Lenovo ID verification flaw
jedisct1 · x · 2026-09-03
Dropbox disclosed that roughly 5,000 accounts were accessed without authorization between August 4 and 21, with files viewed or downloaded in fewer than a third of them.
The attack vector was strikingly simple: registering a Lenovo ID with someone else's email address was enough — Dropbox trusted Lenovo's verification and handed over a session. Dropbox has terminated every Lenovo ID session and notified regulators.
Related event: Dropbox Breach Exposes ~5,000 Accounts via Lenovo ID Flaw(3 posts)→
More from Safety
- Privacy evals: Muse Glimmer-30B leaks less than Qwen3.6-27B on CIMemories — TimDarcet · 2026-10-21
- Policy experts urge BIS and DDTC to assess frontier models' ability to aid export-controlled tech — jachiam0 · 2026-10-21
- Fake-stats site deindexed by Google was still cited by ChatGPT for 7 months — petrusenko_max · 2026-10-21
- Princeton launches AI Alignment and Safety research initiative — HazanPrinceton · 2026-10-21
- ByteDance, Alibaba, Tencent order 3M+ Nvidia RTX PRO 5500 cards worth $35B, Reuters reports — SumitGup · 2026-10-21
- CVSS 10.0 RCE vulnerability disclosed in PHP core, patches only for PHP 8 — cyb3rops · 2026-10-21