On September 2, 2026, Dropbox disclosed that an attacker accessed roughly 5,000 accounts by abusing a flaw in Lenovo’s email-verification process to register fraudulent Lenovo IDs — never needing the victim’s Dropbox password. Audit every identity-federation link you accept and require re-authentication on SSO sign-ins.

With 87,000 GitHub stars and v2.1.2 released in July 2026, Syncthing proves that P2P end-to-end encrypted sync can replace Dropbox — no central server, no subscription. If your files still cross the Atlantic to move between two machines on the same desk, it’s time to stop.