Dropbox said on Tuesday that around 5,000 accounts were compromised last month, with hackers viewing and downloading content stored on the cloud-storage platform.
Some Dropbox users received an email from the company on Monday notifying them that their accounts have been accessed without authorization between August 4 and August 21, Dropbox confirmed after Bloomberg News reported the hack earlier in the day.
Hackers accessed files in fewer than a third of the compromised accounts, the company said.
Shares of Dropbox fell around 2.4% in extended trading on Tuesday.
Dropbox told Reuters that it identified unauthorized access affecting accounts linked to a Lenovo ID that did not have its two-factor authentication enabled, prompting the company to terminate all sessions authenticated through a Lenovo ID.
The company has removed any links between Lenovo IDs and Dropbox accounts and changed its systems so that users must enter their Dropbox password before accessing an account through Lenovo.
Dropbox said it had reported the incident to data protection regulators.
Lenovo identified a "legacy integration" between Lenovo ID and Dropbox that "could be used to improperly authenticate certain Dropbox accounts". The company said its own customers were not affected and that an investigation was ongoing.
