Dropbox says about 5,000 accounts compromised in August hack

Dropbox disclosed on Tuesday that approximately 5,000 user accounts were breached during a security incident in August, according to the company’s statement. The breach occurred between August 4 and August 21, with unauthorized individuals gaining access to some of the affected accounts and downloading stored content. The company informed users via email on Monday, confirming the breach following initial reports from Bloomberg News. The breach involved accounts associated with Lenovo IDs that lacked two-factor authentication. Dropbox stated that these accounts were vulnerable because they could be accessed without requiring additional verification steps. As a result, the company terminated all sessions authenticated using Lenovo IDs and took measures to prevent future unauthorized access. Users will now need to input their Dropbox password before logging into their accounts through Lenovo devices. In response to the breach, Dropbox has taken several steps to secure its system. It has severed the connection between Lenovo IDs and Dropbox accounts and modified its processes to ensure that users must enter their Dropbox password prior to accessing their accounts through Lenovo. These changes aim to close potential security gaps that could allow unauthorized access. Lenovo acknowledged the issue, identifying a "legacy integration" between its ID service and Dropbox that might have allowed improper authentication of certain Dropbox accounts. The company emphasized that its own customers were not impacted by the breach and that an investigation into the matter is still underway. Lenovo is working to understand how this integration could have posed a risk and is taking steps to address it. The security incident led to a decline in Dropbox's stock price, which dropped by roughly 2.4 percent in extended trading on Tuesday. This reflects investor concerns over the potential impact of the breach on the company’s reputation and financial stability. Dropbox has also notified relevant data protection authorities about the incident, as required under regulatory guidelines. Users who were affected by the breach were sent notifications by Dropbox, alerting them to the unauthorized access to their accounts. While the exact number of users whose files were accessed remains unclear, Dropbox indicated that less than a third of the compromised accounts had files accessed by the attackers. The company has not yet released further details regarding the extent of data exposure or the specific types of information that may have been accessed. The situation highlights the importance of multi-factor authentication in protecting online accounts from unauthorized access. Dropbox’s actions demonstrate a commitment to improving security measures, though the incident underscores broader challenges related to data privacy and cybersecurity. As investigations continue, both Dropbox and Lenovo are likely to provide more detailed updates on the matter in the coming weeks.