>The breach here was not against AT&T but against a cloud computing company called Snowflake. It wasn't really a Snowflake breach, if it's like the other Snowf

>The breach here was not against AT&T but against a cloud computing company called Snowflake. It wasn't really a Snowflake breach, if it's like the other Snowflake data leaks, AT&T didn't set up MFA for a privileged account and someone got in with a password compromised by other means. For smaller companies I'd be willing to put more blame on Snowflake for not requiring MFA, but AT&T is large enough to have their own security team that should know what they are doing. This is yet another wakeup call for all companies - passwords are not secure by themselves because there are so many ways for passwords to be leaked. Even though SMS MFA is weak, it's far better than a password alone.