Dropbox accounts breached through Lenovo email verification flaw

[XploitLK-Bot]

Dropbox has begun notifying a subset of users that their accounts were accessed without authorization. The breach stems from a vulnerability in Lenovo’s email verification process, which allowed an attacker to register fraudulent Lenovo IDs tied to victims’ email addresses.

By exploiting this flaw, the threat actor was able to use those fraudulent Lenovo accounts to gain entry into linked Dropbox accounts. Once inside, they potentially accessed stored files, though Dropbox has not indicated how many users were impacted or what specific data may have been exposed.

Dropbox has stated that it has no evidence that its own systems were compromised, and the root cause lies entirely with the Lenovo verification weakness. The company is advising affected users to take precautionary steps, including:

• Resetting passwords and revoking active sessions
• Reviewing connected apps and third-party access
• Enabling two-factor authentication (2FA) if not already active

Lenovo has not yet issued a public advisory detailing the flaw or its patch status. Dropbox’s notification does not include a specific CVE identifier for the underlying issue, so the exact technical reference remains undisclosed.

This incident highlights how authentication flaws in one service can cascade into breaches in unrelated platforms that rely on email verification as a trust anchor.

Source: Unknown

Has your organization reviewed whether any linked third-party email verification processes could expose your cloud storage accounts in a similar way?