Lenovo Shares Fall After Dropbox Security Breach Exposes ID Vulnerability

Lenovo Group shares came under pressure on Wednesday after a security breach at Dropbox revealed a vulnerability connected to the Chinese technology company's Lenovo ID authentication service.

Dropbox said approximately 5,000 user accounts were compromised during a cyberattack in August. Hackers were able to view and download files from fewer than one-third of those accounts, raising concerns over the security of the authentication integration between Dropbox and Lenovo.

The unauthorized activity took place between August 4 and August 21. According to Dropbox, the affected accounts were connected to Lenovo ID and did not have two-factor authentication enabled, making them vulnerable to unauthorized access.

Lenovo shares listed in Hong Kong dropped as much as 3.3% to HK$29.56 following news of the security incident. The stock later recovered its losses and was trading roughly flat by 04:00 GMT.

Dropbox responded to the breach by terminating all active sessions that had been authenticated through Lenovo ID. The cloud storage company also removed connections between Lenovo IDs and Dropbox accounts and introduced additional security requirements.

Users attempting to access Dropbox through Lenovo will now be required to enter their Dropbox passwords, adding another authentication layer intended to prevent similar unauthorized access.

Lenovo described the security weakness as stemming from a "legacy integration" between its Lenovo ID service and Dropbox. The integration could reportedly be exploited to improperly authenticate certain Dropbox accounts.

The PC manufacturer stressed that Lenovo customers themselves were not affected by the Dropbox security breach. Lenovo said it has launched an investigation into the vulnerability and is working to determine the circumstances surrounding the incident.

The episode highlights growing cybersecurity risks surrounding third-party identity services and older authentication integrations, particularly when accounts lack protections such as two-factor authentication. Investors will likely monitor Lenovo and Dropbox for further findings from their investigations and any additional measures introduced to strengthen account security.