Lenovo Shares Fall After Dropbox Hack Exposes Legacy Integration Flaw

Shares of Lenovo Group (HK:0992) declined in Hong Kong trading after a security incident at cloud storage provider Dropbox (NASDAQ:DBX) was traced to a vulnerability in a legacy integration with the PC maker's identity service.

Details of the Breach

Dropbox disclosed that a hacking incident in August compromised approximately 5,000 of its user accounts. The unauthorized access took place between August 4 and August 21, according to a company statement. Attackers were able to view and download files from fewer than one-third of the affected accounts.

The breach specifically impacted users whose Dropbox accounts were linked to a Lenovo ID and did not have two-factor authentication enabled. Lenovo identified the issue as a "legacy integration" between the two services that could be exploited for improper authentication.

Ad

Market Reaction and Company Response

Following the news, Lenovo's Hong Kong-listed shares fell by as much as 3.3% to HK$29.56 before paring those losses to trade flat later in the session. The incident highlights the potential market impact of security vulnerabilities, even when they originate from third-party integrations.

In response, Dropbox has terminated all sessions authenticated through Lenovo ID, removed the links between the accounts, and prompted affected users to enter their Dropbox passwords to regain access. Lenovo stated that its own customers were not affected and that an investigation into the matter is underway.