Cyber Security

Twilio’s Authy App Breach Exposes Millions of Phone Numbers

Jul 04, 2024NewsroomData Breach / Mobile Security

Cloud communications provider Twilio has revealed that unidentified threat actors took advantage of an unauthenticated endpoint in Authy to identify data associated with Authy accounts, including users’ cell phone numbers.

The company said it took steps to secure the endpoint to no longer accept unauthenticated requests.

The development comes days after an online persona named ShinyHunters published on BreachForums a database comprising 33 million phone numbers allegedly pulled from Authy accounts.

Authy, owned by Twilio since 2015, is a popular two-factor authentication (2FA) app that adds an additional layer of account security.


“We have seen no evidence that the threat actors obtained access to Twilio’s systems or other sensitive data,” it said in a July 1, 2024, security alert.

But out of an abundance of caution, it’s recommending that users upgrade their Android (version 25.1.0 or later) and iOS (version 26.1.0 or later) apps to the latest version.

It also cautioned that the threat actors may attempt to use the phone number associated with Authy accounts for phishing and smishing attacks.

“We encourage all Authy users to stay diligent and have heightened awareness around the texts they are receiving,” it noted.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Articles You May Like

New Ray-Ban Meta Smart Glasses Outsell Previous Version, Says Essilux CEO
Alert: HotPage Adware Disguised as Ad Blocker Installs Malicious Kernel Driver
CrowdStrike Update Error Debacle: 5 Things to Know About Microsoft’s Global Outage
OnePlus Nord 4 With Snapdragon 7+ Gen 3 SoC, 100W SuperVOOC Charging Launched in India: Price, Specifications
Dyson OnTrac Headphones With Customisable Ear Cushions, Up to 50 Hours of Battery Life Launched