Twilio's Authy Service Hit by Data Breach: Millions of Phone Numbers Exposed

Twilio's Authy Service Hit by Data Breach: Millions of Phone Numbers Exposed
Image credit: Twilio website 

Twilio has reported that phone numbers linked to its two-factor authentication service, Authy, have been compromised, potentially exposing users to phishing attacks and other scams. This information was first covered by TechCrunch.

The breach follows a 2022 incident where attackers, through a phishing campaign, tricked Twilio employees into revealing their login credentials. This allowed the attackers to access data from 163 Twilio accounts and register additional devices on 93 Authy accounts. 

The leak was traced back to an unsecured endpoint, which Twilio has now secured. Recently, the threat actor ShinyHunters released a list of 33 million phone numbers from Authy accounts on the dark web. According to BleepingComputer, ShinyHunters exploited an unsecured API endpoint in Authy by inputting a large list of phone numbers to check their association with the app.

Twilio has reassured users that there is no evidence the attackers accessed Twilio’s systems or other sensitive data and that Authy accounts themselves were not compromised. The company encourages all Authy users to be vigilant about the texts they receive and advises them to update their Authy apps on Android and iOS. The Authy desktop app has been discontinued.