When MFA isn't actually MFA

On August 29, 2023, Retool notified 27 cloud customers that there had been unauthorized access to their accounts. The attacker was able to navigate through multiple layers of security controls after taking advantage of one of our employees through a SMS-based phishing attack.