Dropbox said unauthorised access affected accounts linked to Lenovo IDs without two-factor authentication, prompting it to terminate all Lenovo ID-authenticated sessions.