Twilio data breach affects customer phone numbers

Twilio data breach overview: 

• Who: Cloud communications company Twilio confirmed it suffered a data breach after a hacker known as ShinyHunters posted on a hacking forum that they stole 33 million of its customers’ phone numbers. 
• Why: Twilio attributed the data breach to threat actors identifying data associated with its Authy accounts via an unauthenticated endpoint. 
• Where: Twilio offers phone numbers in all 50 US states and all Canadian provinces. 

Cloud communications company Twilio has confirmed it suffered a data breach after a hacker claimed in late May to have stolen 33 million of its customers’ phone numbers. 

Twilio confirmed the data breach after a hacker(s) known as ShinyHunters posted on a popular hacking forum that they had stolen the cell phone numbers of 33 million Twilio users, reports TechCrunch. 

In a security alert published July 1, the company said threat actors were able to “identify data” associated with its Authy accounts — including phone numbers — due to an “unauthenticated endpoint.” 

“While Authy accounts are not compromised, threat actors may try to use the phone number associated with Authy accounts for phishing and smishing attacks,” Twilio said in its security alert. 

Authy is a widely-used two-factor authentication app owned by Twilio, reports TechCrunch. 

No evidence that Twilio systems were accessed by threat actors, company says

Twilio said it found no evidence a threat actor was able to access its systems or “other sensitive data” but encouraged all Authy users to “stay diligent” and “have heightened awareness” about any texts they receive. 

“We know the security of our systems is an important part of earning and keeping your trust. We sincerely apologize that this happened,” the company said. 

Twilio also recommended its Authy users to update to the latest iOS and Android apps so they can receive the latest security updates and bug fixes. 

The digital communication platform previously suffered a data breach in 2022 that the company attributed to a phishing attack. 

Twilio said at the time that a “limited number” of customer accounts were compromised during the data breach after its employees were tricked into revealing their login credentials. 

“This broad based attack against our employee base succeeded in fooling some employees into providing their credentials,” Twilio said in a blog post published at the time. 

Were you affected by the Twilio data breach? Let us know in the comments.

Read About More Class Action Lawsuits & Class Action Settlements:

• Intuit class action claims co. failed to prevent TurboTax, Credit Karma data breach
• Consumers file multiple class actions over Evolve Bank data breach
• TeamViewer data breach attributed to Russian hackers
• Class action claims CDK data breach affected car dealerships, customers, employees nationwide