“IdentifyMobile, a provider of 2FA-SMS, shared the sent one-time passwords in real-time on the internet.”
Google, Amazon, Facebook, Microsoft, Telegram and Airbnb handed login codes to a contractor most of their users never heard of. IdentifyMobile streamed more than 198 million of those SMS live on a subdomain anyone can guess, “idmdatastore”. The feed carried phone numbers and 1-click login links. Your second factor is only as strong as the cheapest vendor in the chain.