Data breach alert: Over 10 lakh account passwords and 2FA codes from Google, Instagram and other accounts compromised

Tech companies typically do not send 2FA codes directly to their users’ phone numbers. Instead, messages are routed through a sprawling network of intermediate providers — companies that specialise in delivering messages quickly and at low cost across borders. Fink Telecom, a small Switzerland-based provider, was one of these middlemen.

Lighthouse Reports’ cache of messages shows how Fink routed messages for over 1,000 companies — including banks, online marketplaces, dating sites and messaging apps — through its network. The messages often included phone numbers, account IDs and the actual 2FA codes — all visible to Fink and its partners, putting account security at risk.

Why it matters

This breach underscores a growing vulnerability in the ecosystem for delivering messages. The industry’s practice of outsourcing delivery to numerous providers — often based in jurisdictions with weak oversight — means messages can pass through companies that have little accountability and poor safeguards.

This is not a small oversight. The messages routed through Fink were meant to be kept private and routed safely to their recipients. Instead, many were exposed to a range of companies, surveillance providers and fraudsters who could intercept or exploit this data.

What can you do about it?

To help protect your accounts in light of this breach, consider taking the following steps:
Enable an Authenticator App: Whenever possible, use an app like Google Authenticator or Microsoft Authenticator instead of SMS messages for 2FA codes.
Change Your Passwords: If you suspect your phone number or account may have been compromised, consider changing your password immediately.
Watch for Unusual Activity: Monitor your account activity for suspicious transactions or messages.
Remove Phone Number 2FA: Where supported, consider removing phone SMS 2FA in favour of more robust methods.
Switch to Passkeys: Most companies now support passkeys. It is advisable to switch to a passkey login option to keep your accounts safe.