Dropbox said around 5,000 accounts were compromised in an August hack, with hackers accessing and downloading content stored on the cloud-storage platform.
The unauthorised access took place between August 4 and August 21 and affected accounts linked to a Lenovo ID without two-factor authentication enabled. Dropbox said files were accessed in fewer than a third of the compromised accounts.
Dropbox has since terminated all sessions authenticated through Lenovo ID, removed links between Lenovo IDs and Dropbox accounts and changed its systems to require users to enter their Dropbox password when accessing an account through Lenovo.
Lenovo said the incident involved a “legacy integration” between Lenovo ID and Dropbox that “could be used to improperly authenticate certain Dropbox accounts”. It said its own customers were not affected and that an investigation was ongoing.
Dropbox said it had also reported the incident to data protection regulators.
Shares of Dropbox fell about 2.4% in extended trading on Tuesday.
Reuters
