Dropbox's own infrastructure was not breached

Assessment

True and beside the point. No Dropbox server, database or credential store was compromised; the attacker walked through the Lenovo ID sign-in path exactly as Dropbox had configured it. Dropbox's notification, Lenovo's statement and every report agree. What the statement omits is that the configuration itself, binding a never-linked identity provider to an account on an email match with no password, was the vulnerability. An authentication path that admits the wrong person is a breach of the account whether or not any system was "hacked."