[IgorPartola]

So what they are saying is that SendGrid should have had two-factor auth and this would have never happened.

[Meekro]

SendGrid's policy (as stated in their first email) is that the support people shouldn't be changing account emails in this fashion. Even if SendGrid had 2 factor auth, who's to say the support guy wouldn't have just disabled that?

[jrochkind1]

If their policy is that support staff should never be able to change an accounts email address... why does the system let them do it?

[IgorPartola]

At some point someone has direct DB access and can do this. Sure, normal support people don't but this just makes the social engineering aspect a bit more complex, not impossible.

[IgorPartola]

With TFA if the email got changed it would not make a difference. The attacker would need the second factor to rest the password and to log in. So the worst they could do is to lock out the account owner. The support staff being socially engineered is a different story, but yes this is a security hole in SendGrid's system and an easily patched one at that.