Skip to the main content.
Talk to sales Start for free
Talk to sales Start for free

1 min read

Leaked database puts tech giants' 2FA codes at risk

Leaked database puts tech giants' 2FA codes at risk

In a critical security lapse, YX International, an Asian technology company, inadvertently exposed a database containing one-time security codes for major tech giants like Facebook, Google, and TikTok, potentially putting millions of users at risk.


What happened

YX International, specializing in cellular networking and SMS text message routing, left a crucial internal database exposed without a password. Security researcher Anurag Sen reportedly discovered the breach, revealing that the database contained sensitive information, including two-factor authentication (2FA) codes and password reset links for users of prominent online platforms.


Going deeper 

The exposed database, included internal email addresses and corresponding passwords associated with YX International. The company claims to have promptly sealed the vulnerability upon notification but remains silent on the duration of the exposure. The exact number affected is still unknown. According to their website, they send 5 million SMS messages daily.


What was said

In response to the incident, YX International's representative stated, "We have sealed this vulnerability," emphasizing their commitment to cybersecurity. The company reassured users that there is no evidence of information misuse and offered 12 free months of identity monitoring.


Why it matters

While 2FA codes enhance online security, this incident stresses the vulnerability of SMS-based authentication. Unlike more secure methods, SMS codes are susceptible to interception, as demonstrated by the exposed database.



How do SMS-based 2FA codes compare to other, more secure methods?

While SMS-based 2FA provides an additional layer of security, it is less secure than app-based code generators. SMS codes can be intercepted, stressing the need for users and companies to adopt more advanced authentication methods to prevent unauthorized access.


How can healthcare organizations enhance cybersecurity for patient data beyond traditional measures?

Healthcare organizations should implement advanced encryption protocols, conduct regular security audits, and invest in employee training to fortify defenses against evolving cyber threats. 


In the event of a cybersecurity incident, what immediate steps should healthcare organizations take to mitigate the impact on patient care?

Healthcare entities should have a well-defined incident response plan involving quick identification, isolation, and containment of the breach. Communication protocols, both internal and external, must be activated promptly, and affected systems should undergo thorough forensic analysis to understand the extent of the compromise. 

Subscribe to Paubox Weekly

Every Friday we'll bring you the most important news from Paubox. Our aim is to make you smarter, faster.