Overview
Dropbox Inc (NASDAQ:DBX) shares declined 1.8% in after‑hours trading on Tuesday after Bloomberg reported a security breach that compromised approximately 5,000 user accounts.
Breach Details
The unauthorized access occurred between 4 August and 21 August, as disclosed in notification emails sent to affected users on Monday. Hackers accessed files in fewer than one‑third of the compromised accounts; some users were informed that their files were viewed and downloaded, while others received notice that no such activity was detected.
Cause of the Incident
The breach stemmed from a vulnerability in Lenovo Group Ltd’s email verification process, which permitted attackers to register Lenovo IDs using Dropbox users’ email addresses without authorization. These illegitimate Lenovo IDs were then employed to authenticate and gain access to Dropbox accounts that were not protected by multifactor authentication.
Company and Lenovo Responses
Dropbox spokesperson Tim Rathschmidt stated that the company has notified regulators and the affected users, and that it does not anticipate a material impact on its business. Lenovo confirmed awareness of a “legacy integration” between Lenovo ID and Dropbox that could be misused for authentication, affirmed that its customers were not affected, and indicated that an investigation is ongoing. Both companies have collaborated to remediate the security issue.
Market Reaction
The news prompted a 1.8% decline in Dropbox’s share price in after‑hours trading.