Dropbox Shares Fall After Report of Data Breach Affecting 5,000 Accounts

Shares of Dropbox Inc. (NASDAQ:DBX) fell 1.8% in after-hours trading on Tuesday following a Bloomberg report that hackers breached approximately 5,000 user accounts and accessed stored data last month.

Details of the Breach

The unauthorized access occurred between Aug. 4 and Aug. 21, according to a company statement cited by Bloomberg. While about 5,000 accounts were compromised, hackers accessed and downloaded files from less than a third of them.

Dropbox spokesperson Tim Rathschmidt confirmed that the company has notified regulators and all affected users. The company noted that the breached accounts were not protected by multifactor authentication, a key security measure that adds a second layer of verification.

Lenovo Integration Exploited

Ad

The breach was not a direct result of a vulnerability in Dropbox's own systems but rather an exploit of a third-party integration. Hackers leveraged a flaw in Lenovo Group Ltd.’s email verification process to gain access.

According to the report, this allowed them to register Lenovo IDs using Dropbox users’ email addresses without authorization, which were then used to authenticate and access the cloud storage accounts. In a statement, Lenovo confirmed it was aware of a "legacy integration" with Dropbox that could be used for improper authentication and that the two companies worked to resolve the issue. Lenovo said its own customers were not affected.

Market Impact and Company Outlook

News of the security incident prompted a negative reaction from investors, pushing the stock down in extended trading. However, Dropbox does not expect the breach to have a material impact on its business or financial results, according to Rathschmidt. The company is continuing to investigate the matter alongside Lenovo.