If I understand this correctly, Dropbox let attackers link unverified Lenovo accounts to unrelated users' Dropbox accounts, without having the user confirm first.

Dupes from yesterday:

Dropbox Data Breach (HN discussion started by an affected Dropbox user): https://news.ycombinator.com/item?id=49514427

Drobox Got Hacked (Twitter): https://news.ycombinator.com/item?id=49514471

I submitted the new link because they didn't get much traction and this article seemed a bit more thorough.