Many attacks on ISP / IaaS companies have involved social engineering to "SIM swap"; allowing intercepting 2FA SMS messages. https://www.wired.com/2016/06/hey-

Many attacks on ISP / IaaS companies have involved social engineering to "SIM swap"; allowing intercepting 2FA SMS messages. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... Other comments expalain the vulnerbility of phones, but Linode's Time-based One-time Password implementation (tied to a phone app) may have been hacked server-side. http://www.securityweek.com/how-attackers-likely-bypassed-linodes-two-factor-authentication-hack-pagerduty http://www.securityweek.com/how-attackers-likely-bypassed-li...