Dropbox says about 5,000 accounts compromised in August hack

Dropbox says about 5,000 accounts compromised in August hack

Dropbox has said about 5,000 user accounts were compromised during an August security breach involving an authentication link with Lenovo ID.

The unauthorised access occurred between August 4 and 21. Dropbox said attackers viewed or downloaded files from fewer than one-third of the affected accounts.

The incident affected Dropbox accounts connected to Lenovo IDs that did not have two-factor authentication enabled. Reports on the breach indicate attackers could register Lenovo identities using targeted email addresses and then use the third-party authentication system to gain access to corresponding Dropbox accounts without obtaining their Dropbox passwords.

Dropbox has terminated sessions authenticated through Lenovo ID and removed links between Lenovo identities and Dropbox accounts. The company has also changed its login process so that users must enter their Dropbox password before accessing an account through the integration.

Affected users were notified by email, while the disclosure put renewed attention on the security risks created when cloud services rely on external identity providers for account access.