Hackers compromised about 5,000 Dropbox accounts by exploiting a flaw in a legacy login integration with Lenovo, allowing them to access cloud storage accounts using victims’ email addresses.

The unauthorised access occurred between August 4 and August 21, with files viewed or downloaded from fewer than one-third of the affected accounts.

Dropbox said none of the compromised accounts was protected by multifactor authentication.

The incident involved Lenovo ID, which Dropbox accepted as an identity provider. An issue with Lenovo’s email verification process allegedly allowed attackers to register Lenovo IDs using email addresses belonging to Dropbox users, even when those users had never created a Lenovo account.

Attackers could then use the newly registered Lenovo ID to enter the Dropbox account associated with the same email address.

Dropbox has notified affected users and data protection regulators. Some users were told their files had been viewed or downloaded, while others received notifications saying there was no evidence their stored material had been accessed.

The cloud storage provider terminated all sessions authenticated through Lenovo ID and removed the connections between Lenovo IDs and Dropbox accounts.

Dropbox also changed its authentication process, requiring users to enter their Dropbox password before accessing an account through Lenovo ID.

Lenovo described the vulnerability as involving a “legacy integration” that could be used to improperly authenticate some Dropbox accounts. The companies worked together to address the issue, while Lenovo said its own customers were not affected.

An investigation remains underway.

Dropbox has encouraged users to change their passwords and activate two-step verification. Users should also review third-party services connected to their accounts and secure the email address associated with their Dropbox profile.

Dropbox said it did not expect the incident to have a material impact on its business. Its shares nevertheless fell in after-hours trading following reports of the breach.

Lenovo’s Hong Kong-listed shares also fell as much as 3.3 per cent on Wednesday, before recovering to trade broadly flat later in the session.

It remains unclear whether any Australian Dropbox customers were among the affected users.