AI Weekly Malaysia

Attackers compromised around 5,000 Dropbox accounts by abusing a legacy Lenovo login integration: a flaw in Lenovo's email verification let them register Lenovo IDs using victims' email addresses and access the corresponding Dropbox storage without a Dropbox password. The compromise ran from August 4 to 21; Dropbox has since expired all Lenovo-ID sessions and severed the integration, and confirmed none of the affected accounts had 2FA enabled.

Why: If you ship or maintain federated login / SSO integrations, audit whether any legacy third-party identity provider can grant access to your app without your own password or 2FA gate — this incident shows that a weak email-verification step on the partner side can bypass your account security entirely. Also a concrete prompt to enforce 2FA for your own users, since every compromised account here lacked it.