For more information about our Incident Response and Communications please read this support article.

We also maintain a list of Known Product Issues separate from this site here.

[Major]: Issues receiving messages from Box's two factor authentication service
Incident Report for Box
Postmortem

NOTICE AND DISCLAIMER: CUSTOMER UNDERSTANDS AND AGREES THAT THIS IS PRELIMINARY INFORMATION SUBJECT TO FURTHER REVIEW AND ANALYSIS BY BOX. TO THE BEST OF OUR KNOWLEDGE, THIS IS THE CURRENT STATE AND WILL BE UPDATED AS MORE INFORMATION IS CONFIRMED.

LAST UPDATED: SEPTEMBER 1, 2020

We recently addressed issues affecting Two Factor Verification. We would like to take the opportunity to further explain these issues and the steps we have taken to keep them from happening in the future.

Between 1:00AM UTC and 10:00PM UTC on August 12, 2020, some users may have experienced difficulties while working in Box. During this time, users who have two factor verification enabled on their account may not have received a SMS with the two factor code. The issue occurred due to a change in filtering behavior by phone network carriers. We were able to resolve the issue by switching to a different phone number and by working with our partners and carriers to remove the filtering. In addition, we are working to improve our two factor verification product to support multiple phone numbers as well as providing our customers the ability to use TOTP instead of SMS to prevent similar issues from occurring in the future. 

 We are continuously working to improve Box and want to make sure we are delivering the best product and user experience. We hope we have provided some clarity here and we would be happy to answer any questions you may still have regarding this matter. 

Sincerely,

The Box Team

Posted Sep 01, 2020 - 13:51 PDT

Resolved
No additional impact was observed and this issue is considered resolved. If you continue seeing any issues with Box 2fa, please contact us at https://support.box.com.
Posted Aug 12, 2020 - 11:36 PDT
Monitoring
A fix was implemented and end-users on the AT&T network should now receive 2FA messages. Users will not receive messages from attempts made during this issue and will only receive messages for new attempts. We will continue internal monitoring to ensure no additional impact is observed.
Posted Aug 12, 2020 - 11:16 PDT
Identified
The source of the issue was identified and we are taking steps to remediate impact. This issue only affects customers on the AT&T network.
Posted Aug 12, 2020 - 10:32 PDT
Investigating
We are investigating an issue affecting customers leveraging Box's two-factor-authentication service, where these messages are not received by end-users. Please note this does not affect customers leveraging an SSO provider's 2FA services. Additional information will be provided as it becomes available.
Posted Aug 12, 2020 - 10:07 PDT
This incident affected: Box Web Application (Login/SSO) and Mobile Applications (Login/SSO).