The Cyber Safety Review Board's 2023 review of Lapsus$ and related groups found that MFA used broadly today is not sufficient for most organizations, because SMS and voice codes can be intercepted. In several cases attackers got in through SIM swapping. The Board recommends moving to phishing resistant, passwordless methods such as FIDO2.
What the review covered
The Board, a public and private body convened by CISA, examined attacks that began in late 2021 and continued into 2022 against dozens of well known companies and government agencies. It engaged nearly 40 organizations and individuals and reviewed about 130 public sources. It did not try to conclusively attribute attacks, and focused on shared techniques.
It noted the group did not use novel zero days. Its success came from social engineering, access sold in underground markets, and weaknesses in telecoms and outsourcing.
The MFA finding
The Board saw a collective failure to account for the risks of SMS and voice calls for MFA. In several instances attackers got initial access through SIM swapping, which let them intercept one time passcodes and push notifications sent by SMS. A paid SIM swap market made this easy to buy.
The report also says adopting stronger MFA is hard for many organizations and consumers because of workflow and usability issues. That honesty matters when you plan the change.
What resisted attack
Organizations with mature, defense in depth controls were most resilient. The Board names those using application or token based MFA, and those with network intrusion detection that spotted suspicious account activity quickly. Those who followed their incident response procedures reduced impact, and the best used out of band communications so responders could not be watched by the attacker.
A migration plan
- Rank accounts by damage if taken over: administrators, email, source control, identity provider.
- Move that top tier to hardware keys or passkeys first.
- Keep SMS only as a last resort for low value accounts, and never as the recovery path for admin accounts.
- Check account recovery and help desk resets, because attackers go around the strong method.
- Plan out of band channels for incident response.
Recovery paths matter
The strongest login is undone if a phone call to the help desk resets it. Require verification steps for resets that match the account's value, and log every reset.
Safeguard's agent identity and policy features cover machine and AI identities, but human MFA lives in your identity provider. Use this review as a checklist for that provider.
What to tell staff and customers
Explain why you are changing, in plain words: codes sent by text message can be intercepted if someone takes over a phone number, and security keys and passkeys cannot be handed over by a phone call. Offer help with setup, give a deadline, and publish an easy path for people who lose a device. Adoption improves when the change is explained and supported.
Quick check
Does the Board say MFA is useless?
No. It says SMS and voice based MFA are particularly vulnerable and recommends phishing resistant methods.
Was Lapsus$ a nation state?
The Board received no evidence that it was affiliated with a nation state or political entity.
Sources
Last reviewed: 19 October 2026.
