Summary
- Environment: Software/Dev tools
- Operational impact: The reviewed source does not establish a precise operational or data impact
- Financial impact: No financial figure is established by the reviewed source evidence
- Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.
What happened
In 2023, Retool experienced an incident in its software/dev tools environment. The retained source describes the attack path as follows: SMS phishing + deepfake voice call impersonating IT + MFA fatigue. [1]
Impact
- The reviewed source does not establish a precise affected-person count, data scope, or operational consequence.
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.
Timeline
Documented public update
The When MFA isn’t actually MFA records the incident facts used in this briefing.
[1]Briefing updated
This briefing was last reviewed and updated on September 19, 2026.
Threat Group & Attack Vector
The retained source describes the attack path as follows: SMS phishing + deepfake voice call impersonating IT + MFA fatigue. The canonical record does not add intrusion steps beyond those supported by the source. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1566 — Phishing — mapped from the cited behavior. [1]
- T1621 — Multi-Factor Authentication Request Generation — mapped from the cited behavior. [1]
Response
The retained source describes system restoration or operational recovery work. [1]
This account is bounded to When MFA isn’t actually MFA. Details absent from that evidence are left unresolved rather than inferred. [1]