Dropbox user accounts breached by hackers who accessed data
Sign up now: Get ST's newsletters delivered to your inbox
A Dropbox spokesperson said the company moved to secure the accounts after learning of the issue.
PHOTO: BLOOMBERG
- Hackers breached about 5,000 Dropbox accounts in August, accessing files on less than a third of them, leading to notifications to affected users and regulators.
- The breach exploited a Lenovo ID issue, allowing hackers to register IDs with users' emails and access Dropbox accounts without multi-factor authentication.
- Dropbox and Lenovo have addressed the problem, with ongoing investigations; Dropbox expects no material business impact from the incident.
AI generated
SAN FRANCISCO – Hackers broke into thousands of Dropbox accounts in August, viewing and downloading material users kept on the cloud storage platform, according to a company statement and records seen by Bloomberg News.
About 5,000 Dropbox accounts were compromised by the hackers, who accessed files on less than a third of them, spokesperson Tim Rathschmidt said in an e-mail.
When Dropbox learnt of the issue, it moved to secure the accounts, he said, adding that the company has since notified regulators and affected users.
Shares of Dropbox fell as much as 6.6 per cent in post-market trading on Sept 1.
Some Dropbox users received an e-mail from the company on Aug 31 saying there was unauthorised access to their accounts between Aug 4 and Aug 21, according to notification e-mails seen by Bloomberg.
The company told some users their files were viewed and downloaded during that time, while others were told there was no evidence of this, the e-mails show.
The compromised accounts were not protected by multi-factor authentication, Rathschmidt said.
The hackers accessed the accounts by using a Lenovo ID, a user name and password that allows users to access products and services made by Lenovo Group, according to the e-mails.
Dropbox users can access their accounts using verified Lenovo IDs, according to one of the e-mails.
Because of an “issue” with Lenovo’s e-mail verification process, the hackers were able to register Lenovo IDs using the emails of Dropbox users, even if they had not set up such an account, the notification e-mails say.
The hackers then used the Lenovo IDs’ to access the accounts.
Lenovo said in an e-mailed statement that it recently became aware of a “legacy integration” between Lenovo ID and Dropbox that “could be used to improperly authenticate certain Dropbox accounts”.
The companies worked together to “mitigate the risk”. Lenovo’s customers were not affected, and an investigation is ongoing, according to the statement.
Dropbox does not expect the breaches to have a material impact on its business, Rathschmidt said. BLOOMBERG
