A leaky database spilled 2FA codes for the world’s tech giants

YX International left an internal, unauthenticated database publicly accessible that contained SMS one-time passcodes, password reset links for major platforms (Facebook, Google, TikTok, WhatsApp), and internal employee credentials. A security researcher discovered and reported the exposure to TechCrunch and the company, which took the server offline and said it had "sealed this vulnerability," but YX would not confirm duration of exposure and reported the server lacked access logs.