Dropbox’s August 2026 Breach: What Happened and Who Was Affected

Dropbox disclosed that an unauthorized party accessed roughly 5,000 user accounts from August 4 through August 21, 2026. The incident was tied to a legacy Lenovo ID authentication connection used for certain Dropbox accounts—not described as a breach of Lenovo’s customer systems. 16

What attackers accessed

Dropbox said attackers viewed or downloaded files from fewer than one-third of the approximately 5,000 affected accounts. That means files were accessed in fewer than about 1,700 accounts; reporting commonly characterized the figure as roughly 1,500. 568

The disclosure does not establish that files were accessed in every compromised account, nor does the available reporting specify the types of files involved.

How the Lenovo ID sign-in path was exploited

The affected Dropbox accounts shared two conditions: they were linked to a Lenovo ID and did not have Dropbox two-factor authentication enabled. 14

According to Dropbox notifications reported by BleepingComputer, an issue in Lenovo’s email-verification process allowed an unauthorized party to register a Lenovo ID using another person’s email address. The attacker could then use that fraudulent Lenovo ID to access the Dropbox account registered to the same address without entering the victim’s Dropbox password. 2

In other words, the weakness involved the trust relationship between the two identity systems. The legacy Lenovo ID route could authenticate a linked Dropbox account when the normal Dropbox account protections had not included a second factor. 26

What Dropbox changed

Dropbox took several steps after identifying the activity:

• It terminated sessions authenticated through Lenovo ID. 46
• It removed or disabled the connection between Lenovo IDs and Dropbox accounts. 46
• It notified impacted users. 15
• It changed the sign-in/linking flow so users must enter their Dropbox password before using the Lenovo ID path. 6

These actions were intended to close the specific authentication route used in the incident.

Was Lenovo itself breached?

Lenovo said it had identified the relevant legacy integration and addressed the issue. It said its own customers and systems were not affected, while the incident affected Dropbox accounts that used the Lenovo ID sign-in route. 68

That distinction matters: the reported compromise was of Dropbox accounts authenticated through the integration, rather than a reported intrusion into Lenovo customer accounts or systems.

Regulators and market reaction

Dropbox told Reuters that it had notified data-protection regulators, although the available reporting does not identify the regulators or jurisdictions involved. 15

Dropbox shares also fell in after-hours trading after the breach disclosure, according to contemporaneous market reporting. 12

The key lesson from the incident

The breach illustrates the risk created when a third-party identity connection is allowed to authenticate an account without equivalent protection at every stage. Here, an email-verification issue and the absence of Dropbox two-factor authentication combined to expose a legacy sign-in route. 26

For affected users, Dropbox’s notification is the most direct record of whether their account was involved and what remediation applies. The broader takeaway is that linked sign-in methods need the same scrutiny as a primary password-and-two-factor-authentication flow.