The security researcher Xusheng Li he removed a flash drive Lenovo ThinkPlus FU100sold in China as a hardware-encrypted storage device AES-256 and unlockable only by fingerprint. Inside the body he did not find any encryption chip, but a very normal one microSD card with the data saved in clear text.
The biometric sensor, explains Li, does not protect the files in any way: it simply enables or disables the USB connection to the computer. Anyone who has physical access to the drive can extract the card, insert it into any reader and read its contents without having to bypass any cryptographic protectionbecause it simply doesn’t exist.
The case, reported by HackingPassion.com, does not only concern the FU100: Lenovo has confirmed that the same architecture is shared by the models FU200, TU800 And TSD303. The company published thenotice LEN-210545 on January 13, 2026, classifying it as high severity and associating it with three distinct CVEs: one concerns the reading of data through physical access, another the exposure of sensitive information in the configuration software, the third an authentication bypass that allows a local user to register unauthorized fingerprints.
Li had reported the flaw to Lenovo already on August 2 last year, receiving as his first response, at the end of the month, a simple buffer solution based on epoxy resin to be applied on the connector, designed more to discourage disassembly than to actually encrypt the data. The researcher then presented the entire analysis at the RE//verse conference in March 2026.
The problem isn’t Lenovo’s, it’s much more widespread
A subsequent analysis, conducted with the support of artificial intelligence tools and published on October 22, extended the suspicions to other USB products sold as “secure”. In NetacFileLock a fixed 32-byte AES-256 key emerged, embedded directly in the executable, plus a password saved in the diagnostic logs with a simple MD5 hash.
Even worse is the case of SecZure YutianDunwhere two hidden accounts, “Buffer” with password, were discovered 123456 and “System” with password SESZURE.COMboth capable of bypassing administrative authentication. Also KakaSoft And Nexcopy Copy Secure they turned out to be based on fixed encryption keys, therefore predictable and replicable by anyone who knows them.
On the Lenovo front, there is currently no firmware update that can be installed independently: those who own one of the affected models must contact Chinese customer service by providing the serial number, to obtain a replacement of the device or an on-site firmware update. No indication, for now, on refunds or on a publicly downloadable version of the firmware. For those who have to return the drive, the most obvious advice remains: first make a backup and then delete everything, because the only real encryption, in this story, is the one that never existed.
