Lenovo Flaw Opened 5,000 Dropbox Accounts, No Password
Dropbox is warning roughly 5,000 customers that intruders reached their accounts through the company's identity federation with Lenovo — without needing a Dropbox password. The flaw was in how Lenovo verified email ownership, not in Dropbox's own authentication.
Key facts
What happened: Attackers used fraudulent Lenovo IDs to sign into Dropbox accounts through a single sign-on integration
Scale: About 5,000 Dropbox customers, some of whom never had a Lenovo account at all
The flaw: A bug in how Lenovo confirms who owns an email address
Who's at fault: Lenovo called it a legacy integration between Lenovo ID and Dropbox, and said its own customers were not affected
Fix: Lenovo has closed the integration; Dropbox expired all sessions created via Lenovo ID and now requires a Dropbox password before any Lenovo ID login
How did attackers get in without a password?
Through trust, not credentials. Dropbox allowed sign-in through Lenovo Identity Provider Services, one of several single sign-on options. Single sign-on, or SSO, lets one account log you into another service — the second service trusts the first to confirm who you are.
Anyone with a verified Lenovo ID could reach the Dropbox account tied to that email address. An attacker exploited the bug in Lenovo's email ownership check, created a fraudulent Lenovo ID, and walked into the victim's Dropbox account. Dropbox honored that confirmation and never asked the account holder to verify through an existing login.
The detail that makes this notable: some of the roughly 5,000 affected people never created a Lenovo account. They were exposed by an integration they never used and likely didn't know existed.
How was it discovered?
By a user noticing something odd. A Dropbox user named xaphod spotted a new "Continue with SSO" option on the login page despite never having created a Lenovo ID. The bug lived at Lenovo, but the only visible symptom appeared inside Dropbox — as a password-free account takeover involving no Dropbox credential.
What should businesses do about federated logins?
Two concrete actions, per the analysis published by Cybersecurity Insiders.
Inventory every federated login path into each account or tenant you run. The Dropbox-Lenovo link went unmapped for years before the breach surfaced it. A trust relationship nobody has written down is one nobody is monitoring.
Confirm ownership locally before honoring a partner's assertion. The warning sign appeared on Dropbox's own login screen days before anyone traced it back to Lenovo. Checking a partner's claim against the account's own login is inexpensive and would have blocked this.
For individuals: open your account settings on the cloud services you use and look at connected accounts or sign-in methods. If there's a company listed you don't recognize or no longer use, remove it.
The broader point
A company can run flawless authentication and still be breached through a partner's mistake. Identity federation quietly made Lenovo part of Dropbox's login security — and the attacker worked that out before Dropbox did. Any organization running federated single sign-on carries the same exposure.
Sources: Cybersecurity Insiders; first reported by BleepingComputer.