A Lenovo login flaw breached 5,000 Dropbox accounts

Assessment

The framing, repeated across coverage, assigns the breach to Lenovo alone. Lenovo's flaw was real: its registration let anyone create a Lenovo ID on an unverified email address. But that only became a Dropbox account takeover because Dropbox accepted a first-time Lenovo assertion as a login for accounts that had never linked Lenovo, with no password check. Dropbox's own remediation, requiring the Dropbox password with Lenovo ID sign-in, is the admission that its side was missing a control. Two failures, one at each company; the claim names one.