Today I noticed something strange on my phone. I opened up my FF browser and noticed a small warning icon on the bottom right. It said, my sync was not logged in and I had to enter my password and 2FA code. After entering these - which I have done quite some time ago already, I immediately got the mail telling me about the new log-in on my account. I mean, I know that it was me, I just logged in. But it got me suspicious because my mobile should already be logged in! So I followed the 'manage devices' link to check the list of my logged-in devices. What I have found is disturbing me. My device was now two times in that list: One saying 'this device' and one stating it is located in another country (USA), last seen a couple of hours ago. I'm from Europe and I certainly have never been in the USA! Of course I removed access immediately!

Is this possibly a bug or even a security breach, that an attacker can 'transfer' a log-in token to another device without any notification? It seems like my mobile's token was removed and so I had to re-log in here. And yes, I use unique passwords with a password manager and 2FA. The only notification I ever saw on this was that my mobile no longer was logged into my sync account!