One-time codes and passwords of millions of users leaked!

TikTok, Instagram, Facebook, and YouTube, among other platforms, have had a database belonging to a firm that organizes one-time codes used for logins leaked. These codes and password reset links sent to millions of users have been exposed.

Two-factor authentication, or "2FA," one of the methods we prefer to ensure security, is implemented by many major social media platforms and cryptocurrency exchanges worldwide. Companies operating in this field implement this technology either by building their own systems or by receiving assistance from third-party businesses. However, a significant security vulnerability occurred in this area today.

LEFT UNPROTECTED

A company named YX International was providing 2FA services via SMS in many countries. However, it was revealed that one of this company's databases was left without a password. The company was helping users perform two-factor authentication by sending more than 5 million SMS messages per day. The leaked database contained one-time codes and password reset links that users utilized when logging into platforms such as Google, Meta, and TikTok.

While there is no clear information on how long the database leak had been ongoing, it was determined that the files examined dated back to July 2023. YX International officials announced that they took the necessary security measures and closed the vulnerability as soon as the incident was discovered.

It is not exactly known how many users' security was compromised by this incident. However, the only thing known is that the codes and password reset links sent to users attempting to log into platforms such as TikTok, Instagram, Facebook, and YouTube were leaked. It is currently unknown whether hackers had discovered this security vulnerability earlier and how they utilized the exploit.

News Source: 12punto