LogFAQs > #968120184

voldothegr8 posted...

How does that happen short of the employee being a dumbass?

Well if I'd go about it, I'd get a list of Rockstar employees from their self-report or LinkedIn, then I'd cross reference their names and emails to existing data breaches to see if there are any employees there who have previously leaked passwords. For any that did, try that password on their rockstar email login and potentially write an algorithm that also guesses variations of that password.
Then you could get lucky with them accepting the 2FA. Perhaps center your login attempt at 9AM their time to make them think 1) the request was delayed, or 2) server duplicated it, or 3) they just forgot to hit it. Or message them with a fake rockstar support email while you spam them 2FA requests and pretend to be IT support and tell them it's an issue that will go away temporarily if they just accept the 2FA.

So yeah the employee needs to be a little bit of a dumbass, but the reality is people are not as careful about their logins as they should be, even people working as programmers or adjacent to them.