Hacked via T-Mobile and Authy – Warning To Be Careful If You Use Any Of These Services

Woke up this morning and had a push notification via Authy that a new device was added.

Checked my email and had email from T-Mobile and Authy saying sim and been swapped and new account was added. It is insane that Authy allows access via sms to begin with.

I had a pin on my T-Mobile account to stop sim swap but they got around that.

I had a password on Authy backup, but that they got around too.

Once they had access to my phone number and Authy, they reset my Outlook password via Authy. I don’t use Outlook and my main email account was still safe but I went in and removed my phone number from that account just in case. Also removed phone from password manager.

All in all, was a clusterfuck but not too much damage so far.

This is a reminder to anyone reading that there are many points of failure with 2FA and phone numbers. Once they get access to your email, it is game over.

Thankfully my crypto is safe because it is all in self custody but just a warning to anyone using centralized exchanges that require 2FA or phone numbers.