Third-Party Attacks Don’t Always Need Your Password

Introduction

We spend a lot of time talking about protecting our passwords, but what happens when a cybercriminal doesn’t need yours?

In August 2026, attackers compromised more than 5,000 Dropbox customers, who learned this when attackers exploited a weakness in a third-party login connection with Lenovo. In doing so, they compromised thousands of user accounts.

Attackers created Lenovo IDs using victims’ email addresses, and then used those accounts to access connected Dropbox accounts. In many cases, they did not need the victim’s Dropbox password at all.

The incident is a great example of an often-overlooked cybersecurity problem: Sometimes your account security depends on more than the company whose brand appears at the top of the page.

How Did the Attack Work?

Many websites allow you to log in through another service.

You’ve probably seen buttons like “Sign in with Google,” “Continue with Apple,” or similar instructions. These connections, known as Single Sign-On options, can make logging in easier because you don’t have to create and remember another password.

Dropbox had a similar connection that allowed certain users to access their accounts through a Lenovo ID.

Attackers found a weakness in Lenovo’s email verification process that let them register Lenovo IDs using other people’s email addresses. They could then use that connection to access Dropbox accounts associated with those same email addresses.

In other words, the attackers found another door to the same information. The incident shows why cybersecurity isn’t always as simple as using strong, unique passwords.

Your Account Can Have More Than One Entry Point

Imagine that your house has an incredibly strong front door. You install the best lock available, never lose your key, and you always remember to lock it.

Unfortunately, there is also a side door connected to the house, and its lock is broken. Although your front door stays perfectly secure, that doesn’t matter very much if somebody simply walks around the side of the building.

Connected accounts can create a similar situation, but digitally.

Your password may be strong and completely uncompromised, but a service you’ve authorized could potentially provide another route into your account if that connection becomes vulnerable.

Multi-Factor Authentication Makes a Difference

So how did the Dropbox incident resolve?

Reports indicate that the attack primarily affected users who did not have two-factor authentication (2FA) enabled. In approximately one-third of the compromised accounts, attackers actually viewed or downloaded user data.

This perfectly encapsulates why multi-factor authentication matters so much.

A password—or in this case, an alternative login method—might get an attacker through the first layer. Requiring another form of verification can stop the attack from going any further than that.

So whenever an account offers MFA or a passkey, use it!

Don’t Forget About Old Connections

The Dropbox incident involved a specific vulnerability that they have since addressed, but the bigger lesson applies to almost every online account.

Over the years, you may have connected dozens of apps and services without realizing it.

Maybe you authorized a scheduling app to access your calendar. You connected a photo editor to your cloud storage. Perhaps you tried an app once, clicked Allow, and haven’t thought about it since.

Those connections don’t necessarily disappear just because you stop using the program, or even if you delete the app from your device.

Every so often, review the apps and services connected to your important accounts. Remove anything you no longer recognize, trust, or use.

How Can You Protect Yourself?

You don’t need to stop using third-party login services altogether. You just need to remember that they factor into your overall cybersecurity, too.

• Use multi-factor authentication or passkeys whenever possible.

• Review connected applications periodically.

• Remove old connections you no longer need.

• Pay attention whenever an application asks for new permissions.

For work accounts, never connect an unapproved application simply because it makes your job easier. Ask your IT department first!

Conclusion

The Dropbox incident shows why cybersecurity isn’t always as simple as protecting your password.

Our accounts are increasingly connected to other apps, devices, and services. Each connection can make our digital lives easier, but it can also create another potential way in.

Protect your password, absolutely. Just don’t forget to check the other doors, too.