Continuation of [Major]: Issues receiving messages from Box's two factor authentication service
Incident Report for Box
Postmortem

NOTICE AND DISCLAIMER: CUSTOMER UNDERSTANDS AND AGREES THAT THIS IS PRELIMINARY INFORMATION SUBJECT TO FURTHER REVIEW AND ANALYSIS BY BOX. TO THE BEST OF OUR KNOWLEDGE, THIS IS THE CURRENT STATE AND WILL BE UPDATED AS MORE INFORMATION IS CONFIRMED.

LAST UPDATED: SEPTEMBER 1, 2020

We recently addressed issues affecting Two Factor Verification. We would like to take the opportunity to further explain these issues and the steps we have taken to keep them from happening in the future.

Between 1:00AM UTC and 10:00PM UTC on August 12, 2020, some users may have experienced difficulties while working in Box. During this time, users who have two factor verification enabled on their account may not have received a SMS with the two factor code. The issue occurred due to a change in filtering behavior by phone network carriers. We were able to resolve the issue by switching to a different phone number and by working with our partners and carriers to remove the filtering. In addition, we are working to improve our two factor verification product to support multiple phone numbers as well as providing our customers the ability to use TOTP instead of SMS to prevent similar issues from occurring in the future. 

 We are continuously working to improve Box and want to make sure we are delivering the best product and user experience. We hope we have provided some clarity here and we would be happy to answer any questions you may still have regarding this matter. 

Sincerely,

The Box Team

Posted Sep 01, 2020 - 13:52 PDT

Resolved
No additional impact was observed and this issue is considered resolved. If you continue seeing any issues with Box 2fa, please contact us at https://support.box.com.
Posted Aug 12, 2020 - 15:37 PDT
Monitoring
A fix was implemented and end-users should now receive 2FA messages. We will continue to monitor to ensure there is no additional impact.
Posted Aug 12, 2020 - 15:04 PDT
Identified
We've identified the source of the issue and initial recovery is underway. We will continue to provide additional updates as they become available.
Posted Aug 12, 2020 - 13:52 PDT
Investigating
We are investigating a resurfaced issue affecting customers leveraging Box's two-factor-authentication service, where messages are not received by end-users. Please note this issue is not isolated to a specific network provider and does not affect customers leveraging an SSO provider's 2FA services. Additional information will be provided as it becomes available.
Posted Aug 12, 2020 - 13:25 PDT
This incident affected: Mobile Applications (Login/SSO) and Box Web Application (Login/SSO).