Lenovo customers were not affected by the Dropbox incident

Assessment

Lenovo's statement, and it follows from the mechanism. The attack required registering a new Lenovo ID on the victim's email address; an address that already had a Lenovo ID could not be registered again, so existing Lenovo account holders were outside the attack surface. The affected population was Dropbox users who had never created a Lenovo ID. The statement is accurate about Lenovo's customers and says nothing about Lenovo's responsibility for the flaw, which Lenovo has acknowledged as an issue in "a legacy integration."