Hackers breach thousands of Dropbox accounts, access user data
What's the story
Cloud storage giant Dropbox has confirmed a major security breach that affected around 5,000 of its user accounts. The company said hackers accessed and downloaded data from some of these accounts. The breached accounts lacked multi-factor authentication, according to spokesperson Tim Rathschmidt. Dropbox has since notified regulators and users whose data may have been compromised in this incident. The company's stock dropped over 6% in Tuesday's after-hours session.
Attack method
Hackers exploited Lenovo ID to access user accounts
The hackers gained access to Dropbox accounts by exploiting a Lenovo ID, which is a username and password combination used to log into products and services offered by Lenovo Group Ltd.
According to Dropbox's notification emails, the attackers were able to create Lenovo IDs using the email addresses of Dropbox users due to an "issue" with Lenovo's email verification process.
Integration concern
Lenovo acknowledges 'legacy integration' with Dropbox
In response to the breach, Lenovo acknowledged a "legacy integration" between Lenovo ID and Dropbox that could be exploited for unauthorized access.
The company said it is working with Dropbox to address the issue.
However, Lenovo's customers were not affected by this security incident, and an investigation into the matter is still ongoing.