Summary
Shares of Lenovo Group fell after Dropbox disclosed a security incident stemming from an integration between the cloud-storage company and Lenovo's identity service. Dropbox said roughly 5,000 accounts were accessed without authorization during an August window, and fewer than a third of those accounts had files viewed or downloaded. Lenovo described the problem as a "legacy integration" that could improperly authenticate some Dropbox accounts, while also stating its own customers were not affected and that an inquiry is ongoing.
Key developments
Hong Kong-listed Lenovo shares declined as much as 3.3% to HK$29.56 in initial trading, before trimming losses to trade flat by 04:00 GMT. The unauthorised access took place between Aug. 4 and Aug. 21, according to Dropbox's account of the incident.
Dropbox said the affected accounts were linked to a Lenovo ID and lacked two-factor authentication. In response, Dropbox terminated all sessions authenticated via Lenovo ID, removed the connection between Lenovo IDs and Dropbox accounts, and required users to re-enter their Dropbox passwords when accessing accounts through Lenovo.
Lenovo described the root cause as a legacy integration allowing improper authentication of certain Dropbox accounts. The company said its own customers were not impacted and that it is conducting an investigation into the issue.
Details reported by the companies
- Dropbox reported that around 5,000 accounts were compromised in an August hacking incident.
- Hackers viewed and downloaded files from fewer than one-third of those affected accounts, per Dropbox's statement.
- The unauthorised access occurred between Aug. 4 and Aug. 21.
- Dropbox stated the implicated accounts were connected to a Lenovo ID and did not have two-factor authentication enabled.
- Remedial steps taken by Dropbox included terminating Lenovo ID authenticated sessions, removing Lenovo ID links to Dropbox accounts, and enforcing password entry for Lenovo-based access.
- Lenovo identified the problem as a legacy integration and said its customers were not affected, with an investigation underway.
Market reaction
Shares of Lenovo reacted to the disclosure, moving down in Hong Kong trading before paring losses. The incident also prompted operational changes by Dropbox aimed at severing the compromised authentication pathway tied to Lenovo IDs.
What remains uncertain
Both companies have described the immediate technical actions taken, but the ongoing investigation will determine broader implications and whether any additional accounts or systems were affected beyond the details already disclosed.