Dropbox User Accounts Breached by Hackers in Major Data Security Incident
Tap title to read story
Dropbox confirmed that approximately 5,000 user accounts were compromised in a security breach occurring between August 4 and August 21, 2026. The unauthorized access stemmed from a legacy authentication integration with Lenovo ID, where an email verification flaw allowed external actors to register fraudulent Lenovo IDs using victims' email addresses and access linked Dropbox accounts lacking multi-factor authentication. Hackers viewed or downloaded files in fewer than a third of the affected accounts. In response, Dropbox terminated all sessions authenticated through Lenovo ID, severed the integration, and mandated native password verification. Both companies reported the incident to data protection regulators, while Dropbox shares experienced minor downward pressure in extended trading.
Timeline
- On August 4 2026 Unauthorized access to Dropbox accounts via the Lenovo ID integration flaw begins.
- On August 21 2026 The unauthorized access window concludes as suspicious activity is isolated.
- On August 31 2026 Dropbox begins emailing affected users to notify them of unauthorized account access.
- On September 1 2026 Bloomberg News breaks the story regarding the Dropbox security breach.
- On September 2 2026 Dropbox and Lenovo formally confirm the breach, affecting roughly 5,000 accounts tied to a legacy authentication flaw.
- Data protection regulators are expected to review formal compliance filings from both companies.
Sources
JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.




































