Signal data breach results in users’ phone numbers exposed

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Signal data breach overview:

• Who: Signal has confirmed that it was affected by a Twilio data breach.
• Why: Signal advises the approximately 1,900 victims of the Signal data breach to enable registration lock in the app’s settings to protect them from threats.
• Where: The Signal breach affects users of the encrypted messaging app.

The secure messaging app Signal has been affected by a data breach that exposed the phone numbers and SMS codes for nearly 1,900 users, TechCrunch reports.

The Signal data breach is reportedly related to a recent Twilio phishing scam targeting employees, which ultimately enabled hackers to access the data of more than 125 Twilio customers. Twilio is a digital communication platform that provides Signal with phone number verification services. 

Although Twilio has not disclosed the identity of the affected customers, Signal confirmed it was a victim of the Twilio data breach.

“For about 1,900 users, an attacker could have attempted to re-register their number to another device or learned that their number was registered to Signal,” Signal wrote in a blog post Monday.

Signal says the hacker searched for three specific phone numbers, and one of those three users told Signal their account had been re-registered. 

When hackers re-register an account, they can send and receive messages from that account, which is associated with the phone number.

The number of users affected by the data breach is “a very small percentage of Signal’s total users, meaning that most were not affected,” the messaging app says.

Message history reportedly not affected by Signal data breach

The hacker reportedly did not have access to users’ message history, which Signal does not store. Contact lists and profile information, which are protected by users’ PINs, were also not accessed, Signal says.

Signal says it will unregister the secure messaging app on all devices currently being used by those affected by the Signal breach. The users will reportedly need to re-register for the app on their preferred device.

Signal also suggests users enable registration lock in the app’s settings to protect themselves against any attempted hacks.

The Signal breach has added to the pressure on the encrypted messaging app to stop using phone numbers, because they may be vulnerable to digit-based schemes, Engadget explains.

What do you think about the Signal data breach? Join the discussion in the comments below!

Read About More Class Action Lawsuits & Class Action Settlements:

• Humana, Cotiviti data breach class action settlement
• OneTouchPoint data breach class actions allege cyberattack affected over 1M patients
• PCS Revenue Control Systems data breach $1.135M class action settlement
• Cisco data breach results in leaked files on dark web