U.S. SEC: Multi-factor authentication had been disabled for 6 months before the official Twitter account was attacked, and has now been re-enabled

The US Securities and Exchange Commission (SEC) updated its official website with the latest developments regarding the unauthorized access incident to the SEC official X account (@SECGov) on January 9. SEC stated: "Although MFA had been enabled on the X account before, it was disabled by X Support at the request of staff in July 2023 due to issues accessing the account. MFA remained disabled until staff re-enabled it after the account was compromised on January 9. Currently, all SEC social media accounts that offer MFA have it enabled."

SEC also confirmed that this was indeed a "SIM swap" attack, where an unauthorized party obtained the phone number through a telecommunications operator rather than the SEC system.