Dropbox confirmed at the beginning of September 2026 that approximately 5,000 user accounts were compromised during a security incident that occurred in August. The attackers managed to gain unauthorized access to those accounts and, in some of them, viewed or downloaded files stored on the platform. The unauthorized access occurred between August 4 and 21, according to information provided by the company. Although the number of affected accounts represents a small fraction compared with the universe of Dropbox users, the incident has raised concern because it highlighted a vulnerability related to an external authentication system.
The case is particularly noteworthy because the problem was not related to a conventional Dropbox password leak. The method used by the attackers was linked to an integration between Dropbox and Lenovo ID, the identification system used by Lenovo so that its users can access certain services. A deficiency in the identity verification process allowed identifiers associated with email addresses belonging to other people to be created. By subsequently using those identifiers to log in, the attackers were able to access certain Dropbox accounts associated with those same addresses.
The company began informing affected users after detecting the irregular activity. Dropbox explained that the attackers were able to access around 5,000 accounts, but that files were viewed or downloaded in fewer than one-third of them. This means that not all users whose accounts were compromised necessarily had their documents accessed. However, the fact that the attackers had access to the accounts represents an important problem in itself, since an unauthorized session may allow them to view personal information, work documents, photographs, and other content stored in the cloud.
The role of Lenovo ID in the incident
The key element to understanding the attack is the integration between Dropbox and Lenovo ID. Dropbox allowed certain Dropbox accounts to be used through an authentication system provided by Lenovo, so that users could access Dropbox without having to directly enter their Dropbox credentials each time. This type of mechanism is common on the internet and is known by different names, including single sign-on or federated authentication. Its main objective is to simplify the user experience and allow an identity previously validated by a provider to be recognized by Dropbox and other services.
The problem arose because the verification process used by Lenovo ID had a deficiency. According to the information disclosed after the incident, an attacker could register a Lenovo ID using another person's email address without adequately demonstrating that they controlled that address. Subsequently, that identity could be used to log in to Dropbox when there was a Dropbox account associated with the same email address. In practice, an email address that was supposed to function mainly as an identifier ended up being used within the authentication chain as if it constituted sufficient proof of identity to access Dropbox.
This difference is fundamental to understanding the nature of the attack. A Dropbox password can be strong, long, and unique and, even so, not completely protect a Dropbox account if there is another access route that avoids requesting that password. In this case, the problem was precisely an alternative authentication route linked to Dropbox. Therefore, the incident demonstrates that protecting a Dropbox account does not consist solely of creating a password that is difficult to guess, but also of carefully controlling all the ways through which a person can gain access to Dropbox.
An old integration became a weak point
Lenovo described the connection with Dropbox as a legacy integration. This concept is especially important in technological systems that have been operating for many years, since companies often retain connections with Dropbox created under security conditions different from those of today. A Dropbox integration may have been considered secure when it was implemented and continue functioning for years without its authentication mechanisms being reviewed as frequently as those of newer systems. Over time, these connections between Lenovo and Dropbox can become blind spots within a company's infrastructure.
Legacy integrations can also be difficult to eliminate because different products and services depend on them. When an organization has thousands or millions of users, modifying a Dropbox login system can involve operational risks, compatibility problems, and significant changes to the access experience. For that reason, companies may maintain old Dropbox mechanisms for a long time, even when more modern technologies already exist to perform the same function. The Dropbox incident demonstrates the consequences that can arise from leaving this type of technological relationship without adequate oversight.
The problem also raises questions about the responsibility companies have when they use external systems to authenticate their users. Dropbox depended on the information provided by Lenovo to determine whether a person could access a Dropbox account. This means that Dropbox's security was partially conditioned by the behavior of the external system. When a platform such as Dropbox relies on another provider to verify identities, it needs to ensure that the security guarantees provided by that provider are sufficiently strong and remain so over time.
The absence of two-factor authentication
Another important element of the incident was the lack of two-factor authentication on the affected accounts. Dropbox indicated that the compromised Dropbox accounts did not have this security measure enabled. Two-factor authentication adds a second verification to the login process, so that knowing or falsifying one identification element should not be sufficient to access the Dropbox account. It can consist of a temporary code, an authentication application, a security key, or certain biometric mechanisms.
The importance of this protection becomes especially clear in this case because the attack managed to exploit an alternative authentication route. When a system such as Dropbox relies on an identity provided by a third party, an additional layer can serve as a barrier before granting a complete session in Dropbox. If the user must demonstrate a second factor controlled directly by them, it becomes more difficult for a falsified external identity to be sufficient to complete the access process to Dropbox. Multi-factor authentication does not eliminate all risks, but it considerably reduces the possibility that a single compromised element will allow an attacker to take control of a Dropbox account.
The fact that none of the affected accounts had this protection enabled constitutes one of the main lessons for Dropbox users. Cloud storage services such as Dropbox can contain considerably more valuable information than an ordinary email account. A personal Dropbox account may include identity documents, photographs, contracts, financial information, or files related to work. In the case of a business Dropbox account, the content may include customer data, internal documents, projects, commercial information, and other materials whose exposure can lead to much more serious consequences.
What information could the attackers obtain?
The number of compromised Dropbox accounts and the number of Dropbox accounts whose files were actually accessed are two different figures. Dropbox indicated that access to documents occurred in fewer than one-third of the affected accounts. This means that approximately two-thirds of the compromised Dropbox accounts showed no evidence that the attackers had viewed or downloaded files, although the Dropbox accounts themselves were exposed to unauthorized access.
The difference is important from the standpoint of assessing the damage. Having access to a Dropbox account does not necessarily mean downloading all the files it contains, but it does allow an attacker to potentially examine its contents and determine what information may be useful. A cybercriminal can search for financial documents, business information, personal data, photographs, contracts, or credentials stored in Dropbox files. Even when a Dropbox document is not downloaded, knowing that it exists can provide valuable information for subsequent attempts at fraud or social engineering.
In addition, access to a Dropbox account can have consequences that go beyond the files directly stored there. Depending on the permissions available, an attacker may attempt to identify other services connected to Dropbox, obtain information about contacts, or take advantage of data found within the documents. A compromised Dropbox account can also become a starting point for subsequent attacks. For that reason, investigations of incidents of this type should analyze not only which Dropbox files were downloaded, but also what actions were possible during the period in which the attacker had access.
Dropbox's response
Once the problem was identified, Dropbox took measures to prevent the route used by the attackers from continuing to function. The company expired the sessions that had been authenticated through Lenovo ID and removed the links between the Dropbox accounts and the corresponding Lenovo identities. It also modified the system so that access to Dropbox through Lenovo would first require the Dropbox password. With this modification, a Lenovo identity alone should no longer be sufficient to enter a Dropbox account.
Dropbox's response is significant because it demonstrates that closing a vulnerability does not always consist of modifying a single piece of code. When there is a trust relationship between Dropbox and another service, it may be necessary to revoke existing sessions, remove previously authorized connections, and change the conditions under which a session in Dropbox is allowed to be established again. Otherwise, a person who obtained access during the period of exposure could continue using a valid session even after the original technical problem had been corrected.
Dropbox also communicated the incident to the corresponding regulatory authorities in matters of data protection. This step is part of the obligations that companies may have when a security incident related to Dropbox involves personal information. Technology companies must assess not only the technical aspect of an intrusion into Dropbox, but also the possible consequences for users and the applicable legal requirements. Dropbox's communication with regulators and affected users is therefore a fundamental part of the response.
Lessons for users
For users of Dropbox and other cloud storage services, the main recommendation is to activate two-factor authentication whenever it is available. This measure can make a considerable difference when a Dropbox password is leaked or when an external authentication route used by Dropbox has a vulnerability. It is also advisable to use unique passwords for Dropbox, so that a problem in one service does not allow the same credentials to be used to access Dropbox or other accounts.
Another important measure is to periodically review the external connections associated with Dropbox accounts. Many users authorize third-party services to access Dropbox and later forget that those authorizations remain active. Dropbox accounts can accumulate integrations with applications they no longer use, login systems that were configured years ago, or external services that have changed their security conditions. Reviewing these Dropbox connections and removing those that are no longer necessary reduces the number of available paths for accessing a Dropbox account.
It is also advisable to pay attention to Dropbox security messages and login notifications. An alert informing of access to Dropbox from an unknown device, a code request that the user never made, or a message related to a Dropbox account that they do not recognize may be a sign of suspicious activity. In situations of this type, changing Dropbox credentials, activating multi-factor authentication, and reviewing active Dropbox sessions can help limit the consequences.
A problem that goes beyond Dropbox
Although the incident directly affects Dropbox, the most important lesson can be applied to practically any platform that uses external authentication systems. Modern companies depend on a huge number of services connected to one another, and Dropbox is an example of how these connections can influence security. A company may use one provider to manage identities, another for storage, another for collaboration, and others for billing, analytics, or device management. Each of these connections can introduce a new security dependency that can also affect services such as Dropbox.
Federated authentication offers important advantages because it allows users to access different services, including Dropbox, through a centralized identity. However, this convenience means that the provider issuing the identity must be treated as a critical security component for Dropbox and for the other connected services. If a company automatically accepts any identity provided by a third party, a failure in that third party's registration or verification process can end up directly affecting the accounts of the receiving company, as happened in the case of Dropbox.
For this reason, organizations should maintain up-to-date inventories of all providers that have the ability to authenticate users of Dropbox and other services. It is not enough to know which companies store information or have direct access to data. It is also necessary to know which providers have the ability to assert that a particular person is who they claim to be and, therefore, can access Dropbox. The Dropbox breach demonstrates that a company can be exposed by a partner that does not necessarily store its files, but that has a critical function within the access process to Dropbox.
The importance of reviewing old technologies
The incident also reinforces the need to review legacy technologies. Organizations often pay close attention to new applications and systems, while old connections involving services such as Dropbox can remain practically forgotten once they have proven to function correctly. However, precisely these systems may present greater risks if they no longer receive frequent updates or if they were designed before certain threats were widely known. The Dropbox case demonstrates that an old integration can continue to play an important role in the security of a platform.
A security audit should identify which Dropbox integrations remain active, what permissions they have, and under what conditions they can be used. It should also determine who is responsible for each connection and when it was last reviewed. If an integration with Dropbox is no longer necessary, removing it is usually a safer option than maintaining it indefinitely. If it remains necessary, it should be subjected to controls equivalent to those applied to any other critical component related to Dropbox.
A warning for cloud security
The Dropbox case represents a warning about an increasingly evident reality: cloud security depends on a chain of trust much broader than the platform itself. Users can choose secure passwords and activate protection mechanisms in Dropbox, but they also depend on the technical decisions made by the companies whose services are connected to Dropbox. A vulnerability at any of these points can generate unexpected consequences for Dropbox and its users.
The figure of approximately 5,000 compromised Dropbox accounts may seem small compared with other major data breaches affecting millions of people. However, the mechanism used makes this Dropbox case a particularly relevant example. The attack demonstrates that it is not always necessary to steal a Dropbox password, install malware, or directly exploit a Dropbox server to gain access to protected information. Under certain circumstances, it is enough to exploit a trust relationship configured incorrectly to ultimately gain access to a Dropbox account.
The August 2026 Dropbox incident leaves a clear conclusion: protecting a modern account requires much more than using a secure password. External authentication systems, legacy integrations, and connections with third parties form part of the attack surface and must receive the same level of attention as the main servers and applications. The Dropbox case demonstrates that a vulnerability in a connected system can ultimately compromise accounts and expose information that users consider private and protected.
For users, some measures are relatively simple, such as activating two-factor authentication, using unique passwords, reviewing external access, and reacting quickly to any alert of suspicious activity on Dropbox or other platforms. For companies, the challenge is considerably greater, since they must keep under control a complex network of providers, identities, applications, and connected services.
Ultimately, the Dropbox incident not only represents a specific problem for the approximately 5,000 affected accounts, but also a warning for all organizations that depend on cloud services. Trust between platforms must be verifiable, limited, and continuously reviewed, especially when external authentication systems or legacy technologies are involved. As dependence on Dropbox and other digital solutions increases, security can no longer be understood as an isolated issue of each application, but rather as the protection of the entire network of relationships that allows users to identify themselves and access their data. The Dropbox case demonstrates that even an old and apparently secondary connection can become one of the most important elements of a security breach.
ITD Consulting helps organizations identify risks, strengthen their technological infrastructure, and develop security strategies adapted to the needs of each company. If your organization uses cloud services, external authentication systems, or multiple connected platforms and you want to learn how to improve their protection, you can contact ITD Consulting by writing to [email protected] and inquire about the solutions available to strengthen your company's security.
EN 
ES