Dropbox Data Breach 9 by hmate9 | 2 comments on Hacker News. I received a security notice from Dropbox today saying that my account was accessed without authorization between August 4 and August 21, 2026, and that Dropbox believes files in the account were viewed or downloaded. According to the email, Dropbox uses Lenovo as an identity provider, allowing users to authenticate to Dropbox with a verified Lenovo ID. Dropbox says: an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address. So, as I understand it, the attack path was roughly: 1. Attacker registers a Lenovo ID using the victim’s email address. 2. Lenovo incorrectly treats the email address as verified. 3. Dropbox trusts the Lenovo identity. 4. Attacker gets access to the Dropbox account associated with that email address. Dropbox says it has since expired all ...