Online file storage and sharing service Dropbox accounts were compromised in August after hackers exploited a flaw involving Lenovo’s account authentication system, with files accessed in some cases. Dropbox said hackers viewed and downloaded files from roughly 5,000 accounts
Wait? Dropbox is still a thing?
Anyway, commenting on this is Brian Higgins, Security Specialist at Comparitech:
“Dropbox has been successfully infiltrated more than once in the past. It’s notable that they are blaming affected account holders for lackadaisical independent security measures which could be an emerging trend for victim organisations.
What also draws attention is the focus on share price fluctuations peri and post breach.
Most companies of commensurate size tend to see a swift bounce-back so it’s worth monitoring the markets for a day or two for any ‘material impact’ on their business.
Unfortunately for anyone affected Tim Rathschmid’s employers fall in to the ‘too big to be bothered’ club. It’s doubtful there will be any notable fallout from this incident but it stands as a salutary tale for anyone who still doesn’t have 2FA.”
Drop Dropbox. Clearly this isn’t safe and you shouldn’t be exposed as a result.
UPDATE: Dan Moore, Sr. Director CIAM Strategy at cybersecurity company FusionAuth, provided the following comments:
“This Dropbox account takeover highlights a dangerous emerging trend where attackers create fake accounts at a trusted federated identity source. The application then accepted tokens from those controlled accounts and linked them to application user profiles without requiring any verification from the real owner. The June Meta AI chatbot exploit worked in a similar way by allowing attackers to add recovery emails to target Instagram accounts and reset passwords. Modifying an account to add an additional login method should require the user to prove they own it.”
Related
This entry was posted on September 2, 2026 at 2:59 pm and is filed under Commentary. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Dropbox says about 5,000 accounts compromised in epic hack
Online file storage and sharing service Dropbox accounts were compromised in August after hackers exploited a flaw involving Lenovo’s account authentication system, with files accessed in some cases. Dropbox said hackers viewed and downloaded files from roughly 5,000 accounts
Wait? Dropbox is still a thing?
Anyway, commenting on this is Brian Higgins, Security Specialist at Comparitech:
“Dropbox has been successfully infiltrated more than once in the past. It’s notable that they are blaming affected account holders for lackadaisical independent security measures which could be an emerging trend for victim organisations.
What also draws attention is the focus on share price fluctuations peri and post breach.
Most companies of commensurate size tend to see a swift bounce-back so it’s worth monitoring the markets for a day or two for any ‘material impact’ on their business.
Unfortunately for anyone affected Tim Rathschmid’s employers fall in to the ‘too big to be bothered’ club. It’s doubtful there will be any notable fallout from this incident but it stands as a salutary tale for anyone who still doesn’t have 2FA.”
Drop Dropbox. Clearly this isn’t safe and you shouldn’t be exposed as a result.
UPDATE: Dan Moore, Sr. Director CIAM Strategy at cybersecurity company FusionAuth, provided the following comments:
“This Dropbox account takeover highlights a dangerous emerging trend where attackers create fake accounts at a trusted federated identity source. The application then accepted tokens from those controlled accounts and linked them to application user profiles without requiring any verification from the real owner. The June Meta AI chatbot exploit worked in a similar way by allowing attackers to add recovery emails to target Instagram accounts and reset passwords. Modifying an account to add an additional login method should require the user to prove they own it.”
Share this:
Like this:
Related
This entry was posted on September 2, 2026 at 2:59 pm and is filed under Commentary. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.