Play store
US technology company Dropbox, which provides cloud storage services, has reported a cyberattack in which hackers gained unauthorised access to around 5,000 user accounts and collected or downloaded files.
The intrusion occurred between August 4 and August 21, Dropbox said, confirming the incident after Bloomberg News first reported it.
The company said hackers were able to view or download confidential files from fewer than one-third of the affected accounts.
According to Dropbox’s initial investigation, the attackers primarily targeted accounts linked to Lenovo ID that did not have two-factor authentication enabled.
The hackers exploited a technical vulnerability in an older integration framework used by Lenovo ID to gain access without obtaining users’ primary Dropbox passwords.
After detecting the breach, Dropbox terminated all active sessions operating through Lenovo ID and severed the connection between the two systems. Users must now enter their Dropbox passwords to regain access.
Dropbox has notified international data protection regulators about the security breach.
Lenovo said in a statement that although some Dropbox accounts were affected through the old technical vulnerability, none of its own customers were victims of the attack.
Dropbox’s shares fell about 2.4% after news of the breach became public.
The company has also begun notifying affected users by email, urging them to change their passwords and take additional security measures.