Computer Repair · November 2, 2026 · ComputerKing Team

Lenovo's 'AES-256 Encrypted' USB Stick Held an Unencrypted SD Card? ThinkPlus Check and Data-Safety Guide

Reports in late October 2026 say Lenovo's ThinkPlus FU100 fingerprint USB stick, sold as AES-256 encrypted, actually contained an ordinary unencrypted SD card, with the fingerprint button only switching the USB connection on. This article shows how to match your model against Lenovo advisory LEN-210545 and what genuinely protects files on a USB stick. Charges require an individual quotation.

Summary: Reports dated 29 October 2026 summarise security research on Lenovo's ThinkPlus FU100 fingerprint USB stick: although sold as AES-256 encrypted, the stick reportedly contained an ordinary unencrypted SD card, and its fingerprint button only switched the USB connection on. Anyone holding the stick who could open the case could read the files without passing the fingerprint check. This article does not tell you to throw away every USB stick, and it does not tell you to open your own stick to verify, since opening the case can damage the stick and affect warranty. It covers three practical matters: matching your model against Lenovo's official advisory, understanding why the official remedy is not a download, and what genuinely protects files on a USB stick. Charges require an individual quotation.

What the news actually says: separate the models and the flaws

The research, presented in a conference talk by Vector 35 developer Xusheng Li, reportedly described the FU100 as "just an SD card in a fancy case". The timeline, as reported, runs: Li reported the flaw to Lenovo on 2 August 2025; Lenovo's first answer, on 27 August, was to glue epoxy over the SD card; the formal security advisory LEN-210545 followed on 13 January 2026, rated high.

The advisory covers four models, according to reporting: ThinkPlus FU100, FU200, TU800, and the TSD303 external SSD. Their flaws are not identical, and they should not be lumped together:

• FU100, FU200, TU800: the core flaw is physical-access reading of stored data, numbered CVE-2025-13453. An attacker who holds the stick and can reach the storage inside can read the files, without knowing a fingerprint or password.
• Two further numbers concern the companion software: CVE-2025-13454 leaks device details to a local user, and CVE-2025-13455 lets someone already signed in add a fingerprint the owner never approved.
• The TSD303 is different: it did encrypt its data, according to reporting, but the flaw sat in the password check. The PC software fetched the correct password from the drive in readable form and compared it with what was typed. A first repair in late 2025 wrapped it in a cipher whose key could reportedly be derived, and a second repair, in December 2025, moved the check onto the drive itself.

One point of proportion matters: according to reporting, neither Lenovo nor the researcher reports attacks on real owners from this flaw. This is a confirmed design problem, not a reported mass breach. But for anyone who stored sensitive files on one of these sticks, "no reported attack" is not the same as "safe to keep treating it as encrypted". Once the stick is lost, the risk already exists.

How this article divides work with earlier articles: Article 76 covers a USB stick not being recognised, Article 97 covers intermittent recognition, Article 122 covers disconnecting mid-copy, and Article 142 covers the "needs formatting" prompt. All of those are "can I use it" problems. This article is a different problem: the stick works perfectly normally, but the encryption promise on the box does not hold. Working does not mean secure.

Step one: match the model, not the shape

Many USB sticks look alike, so the case alone is a poor way to identify one. Use the model name:

1. Check the model on the stick, the packaging, or the purchase record: FU100, FU200, TU800, or TSD303. The FU100 is the model reportedly opened and verified; the other three are the advisory's listed range.

2. If your model is not on the advisory list, do not conclude on your own that it is certainly safe or certainly unsafe. Reporting notes that other brands' encryption tools in the same research were also broken quickly. The lesson generalises: any "hardware encryption" claim is worth verifying with the method in the next sections, rather than trusting the packaging alone.

3. If you are unsure of the model, photograph both sides of the stick and the packaging labels, so a repair shop or support contact can match it in one go, instead of relying on a description like "the black one with a fingerprint button".

Step two: why the official remedy is not a download

The usual first reaction to a security problem is "is there an update to download?" This time, according to reporting, there is not. Lenovo asks owners to contact its service line in China, where a serial-number check decides whether the drive is replaced or upgraded on site. The reason is direct: if the flaw is in the hardware structure itself, no software update can fix it.

Before any enquiry or service visit, two things must come first, in this order:

• Back up first, then wipe. Lenovo itself advises backing up and wiping the drive before service. Copy important files to a place you trust, confirm the copies open, and only then wipe the original. Never wipe first and discover afterwards that the backup missed something.
• Stop putting sensitive files on it. Until the stick is dealt with, treat it as an ordinary unencrypted stick. Company documents, identity scans, and customer data should not go on it. If they already did, think back: was the stick lent to anyone, or missing for a period? If so, treat the data as potentially exposed: change passwords and notify colleagues, rather than just buying a replacement stick.

Small businesses should also use this incident for a stock-take: who holds which company-issued encrypted stick, which have been returned, and which are still unaccounted for. An unreturned stick in a former employee's hands is itself a gap.

Step three: what genuinely counts as encryption

The most useful lesson from this incident is not "do not trust Lenovo", but "the word encryption on the box does not mean the files are encrypted". Genuine protection needs an encryption layer independent of the stick's hardware:

• Use the operating system's own disk-encryption feature (for example BitLocker on Windows, or the FileVault concept on Mac, or another mature encryption tool) to encrypt files before placing them on the stick. Then, even if the stick itself encrypts nothing, the files still carry a layer of protection.
• Use a long, unique encryption password, not shared with the fingerprint or the login password. A fingerprint is convenient, but it cannot be the only lock: this incident proves a fingerprint button can be merely a switch rather than an encryption control.
• Never keep important files only on a stick. Sticks are small, easy to lose, and easy to break, so they are a poor sole backup. Article 79 on this site gives the full backup strategy for Hong Kong users.
• Before sending a stick for service or disposing of it, wipe it properly. Ordinary deletion only removes the index; the data itself remains. Use a reliable wiping method, or seek professional handling.

One line to remember: check whether the files themselves are encrypted, not whether the stick has a fingerprint button.

If the stick is already lost: the stop order

If you use a model in the advisory range and the stick is already lost, buying a new one is not the whole response:

• List what files it ever held, and which of them are sensitive.
• Change any passwords that need changing, immediately, rather than waiting.
• Business users should notify IT and management, rather than handling it quietly alone.
• Only then switch to genuine file encryption plus a second backup copy, as above.

That order sounds tedious, but it is far cheaper than the consequences of assuming encryption that was never there.

Before seeking help: prepare this checklist

If you decide to seek help, having this information ready speeds things up:

• Brand and model of the stick, and the serial number if you can find it.
• Whether it held sensitive files, roughly how much, and whether it is still in your hands.
• Whether a backup exists, where it is, and when the last successful restore test was.
• Whether the stick was lent to anyone or missing for a period, and whether it still works.
• Whether anything was written, deleted, or formatted on it after the incident. Say so honestly; assessment can only be accurate on accurate facts.

On charges: this article gives no prices. Actual charges require an individual quotation and depend on the stick model, capacity, and handling method.

Sources

• Tech Prolonged report: Lenovo's 'encrypted' ThinkPlus USB stick held an unencrypted SD card (November 2026): https://techprolonged.com/2026/11/lenovos-encrypted-thinkplus-usb-stick-held-an-unencrypted-sd-card/
• This site, Article 76, usb-drive-not-recognised: USB stick not recognised
• This site, Article 142, usb-drive-format-prompt-data-first: formatting prompt, data first
• This site, Article 79, backup-strategy-hk: Hong Kong user backup strategy

Related articles

• usb-drive-not-recognised
• usb-drive-format-prompt-data-first
• usb-drive-sometimes-recognised-triage
• backup-strategy-hk