“When asked by TechCrunch, the YX International representative said that the server did not store access logs, which would have determined if anyone other than Sen discovered the exposed database and its contents.”
YX International routes millions of SMS messages and left a database of one-time codes and password reset links for Facebook, WhatsApp, Google and TikTok open to anyone with a browser. No password. No access logs. Nobody can say who else read it. SMS 2FA is only as secure as the cheapest middleman in the routing chain.