Yes. An employee can impersonate a user by registering a device in their name and intercepting the confirmation code and then read all non secret chats and private groups of that user.
At least one employee must have the ability to intercept the code.
(Unless the user has 2fa enabled, but that is not the default configuration.)
There are probably easier ways if we knew more about how the administrate their infrastructure.
At least one employee must have the ability to intercept the code.
(Unless the user has 2fa enabled, but that is not the default configuration.)
There are probably easier ways if we knew more about how the administrate their infrastructure.