Attackers Hit Weak Spots in 2-Factor Authentication
Summary: An attack last week compromised the personal and business Gmail accounts of CloudFlare CEO Matthew Prince, beginning with a flaw in Google's account recovery process for Apps for Business customers that disabled 2-step verification when an administrator account was recovered via a registered secondary email. Prince said the attackers also exploited his personal Gmail lacking 2-factor authentication and tricked AT&T into forwarding his voicemail, and he and the attacker exchanged control of the Gmail account 10 times in 15 minutes.
What's compelling: Prince had a random 24-digit AT&T voicemail PIN, yet the attackers still got past it - so if your account recovery runs through a phone number, your Google account is only as secure as your carrier's support staff.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026