Yes.
RSA got hacked for their SecurID information, so that the attackers could then turn around and get into Lockheed Martin:
* https://gcn.com/articles/2011/06/07/rsa-confirms-tokens-used...
* https://www.scmagazine.com/home/security-news/rsa-confirms-l...
Among other things, LM makes the F-35 fighter:
A good implementation chooses the secret randomly. But both sides need to know what it is. In the example above Anne needs to know both her secrets (they'd be inside her Google Authenticator) and Facebook needs to know both their secrets (probably in a SQL database).
Stealing Facebook backups would get me the (Anne,Facebook) and (Barry,Facebook) secrets, but not the Google ones.
I'm guessing it depends on the implementation, are the server secrets normally derived per user or shared across users (Talking about just a single service such as facebook)?
No. TOTP is a shared secret system, there is only one key.
> I'm guessing it depends on the implementation, are the server secrets normally derived per user or shared across users
Again no. The only reasonable thing to do is pick secrets entirely at random for each user. If the same secret is used then users can trivially impersonate each other, which makes no sense.
Actually what would happen if [large_comapny] had their TOTP secret revealed? Would they be forced to invalidate everyones TOTP? They can't just disable it they would have to somehow authenticate you a third way....