How the Retool breach happened: a deepfaked IT call and one synced code

In August 2023, one text message and one phone call gave an attacker the keys to Retool, a software company used by some of the biggest names in tech, and 27 of its cloud customers had their accounts taken over within days.^[1][2] This case file covers how a fake IT call turned a single login code into all of them, what the attack cost, and the control that would have made the call useless.

What happened

How they got in

Multi-factor authentication, or MFA, means a login needs something beyond a password, often a 6-digit code from an app that changes every 30 seconds. The idea is that a stolen password alone is not enough. Here, the attacker did not steal the code. They asked for it, twice: once on the fake page and once on the phone.^[1][4]

The bigger problem came next. In April 2023, Google Authenticator, a widely used code app, added a feature that backs up and syncs its codes to the user's Google account.^[1][4] Retool's employee had those codes synced. So once the attacker controlled the Okta account, they could get into the Google account, and once in the Google account, they could see every code that app held.^[1][2] Retool's engineering head called this a single point of failure: one account now held what was supposed to be several separate locks.^[1]

With the VPN and admin tools open, the attacker went after a narrow target. They changed email addresses and reset passwords on the accounts of the 27 crypto customers, which let them take control of those accounts.^[1][2]

What it cost

Retool said no customers running its software on their own servers were touched, only cloud customers, and that it revoked all internal sessions, locked the affected accounts and restored their original logins.^[1]

At least one downstream loss followed. Fortress Trust, a crypto custody firm whose customers used a portal built on Retool, disclosed in September 2023 that customer funds had been taken, and the losses were reported at about $15 million.^[3][6] Ripple, which had agreed to acquire Fortress, said it would cover the losses.^[6]

Retool publicly blamed the Google sync feature for making the breach far worse.^[1][2] Google responded that syncing codes is optional and encouraged businesses to move away from one-time codes toward phishing-resistant options such as passkeys and security keys.^[2][3][4] No arrests have been announced.

The missing control

The missing control: phishing-resistant MFA, such as hardware security keys or passkeys, instead of codes a person can read out loud.

A hardware key is a small device that plugs into a laptop or taps a phone. It checks the real web address of the site asking for the login before it answers, so a fake page gets nothing, and there is no code for an employee to type into a lookalike site or recite to a friendly voice on the phone.^[2] In the Retool attack, both handoffs of a code would have failed. The fake portal could not have collected a usable second factor, and the caller would have had nothing to ask for. Keeping those keys off a synced cloud account also removes the single point of failure that turned one stolen login into every login.^[1]

Training helped here: nearly every employee ignored the text.^[4] But training has to work every time, for every person. The attacker only needed one.

What to do in your business

• Start with your email and admin accounts. Turn on security keys or passkeys for email, your domain registrar, payroll and any admin console first. Give each person a spare key so a lost one does not lock them out.
• Set a phone rule and repeat it. Write it down: nobody from IT, the bank or a vendor will ever ask you for a login code. Anyone who does is the attacker, even if the voice sounds right.
• Check where your codes live. If staff use an authenticator app, know whether it syncs codes to a personal or work cloud account, and make sure that account is protected with a key, not just a password.
• Treat IT change announcements as bait. When you move to a new login system, tell staff exactly how and from whom they will hear about it, and that no one will text them a link.
• Know your vendors' blast radius. List the outside tools that can touch your money or customer data, and ask each how they protect their own staff logins.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.