The complaint has also been reviewed by The Washington Post, which interviewed the whistleblower, who filed anonymously out of fear of retaliation.

If an attacker SIM swaps an employee’s number, they may bypass SMS-based MFA protecting corporate email, VPN, and cloud access.