Dropbox says about 5,000 accounts compromised in August hack

Dropbox said on Tuesday that around 5,000 ​accounts were compromised ​last month, with hackers viewing and downloading ​content stored on the cloud-storage platform.

Some Dropbox users received an email from the company ‌on Monday ⁠notifying ⁠them that their accounts have been accessed without authorization between ​August 4 and August 21, Dropbox confirmed after Bloomberg News ​reported the hack earlier in the day.

Hackers accessed files in fewer than a third of ​the compromised accounts, the company ⁠said.


Shares ‌of Dropbox fell around 2.4% in ​extended trading ​on Tuesday.

Dropbox told Reuters that ⁠it identified unauthorized access affecting accounts linked ​to a Lenovo ID that did not ​have its two-factor authentication enabled, prompting the company to terminate all sessions authenticated through a Lenovo ID.

The company has removed any links between Lenovo IDs and Dropbox accounts and changed ‌its systems so that users must enter their Dropbox password before accessing an ​account through ​Lenovo.

Dropbox said ⁠it had reported the incident to data protection regulators.

Lenovo identified a "legacy integration" between Lenovo ID and Dropbox ​that "could be used to improperly authenticate certain Dropbox accounts". The company said its own customers were not affected and that an investigation was ongoing.