Twilio alerts Authy two-factor app users that “threat actors” have their phone numbers

Twilio says someone has obtained phone numbers associated with its two-factor authentication service (2FA), Authy, as reported earlier by TechCrunch. In a security alert on Monday, Twilio warns that the “threat actors” may try to use the stolen phone numbers to carry out phishing attacks and other scams.

The incident follows a 2022 data breach that occurred after a phishing campaign tricked employees into disclosing their login credentials. The attackers accessed data from 163 Twilio accounts and managed to access and register additional devices on 93 Authy accounts.

Twilio traced this leak back to “an unauthenticated endpoint” that it has since secured. Last week, the threat actor ShinyHunters published a list of 33 million phone numbers from Authy accounts on the dark web. As pointed out by BleepingComputer, the threat actor seems to have obtained the information by inputting a massive list of phone numbers into Authy’s unsecured API endpoint, which would then verify whether they’re associated with the app.

“We encourage all Authy users to stay diligent and have heightened awareness around the texts they are receiving,” Twilio writes. It adds that it “has seen no evidence that the threat actors obtained access to Twilio’s systems or other sensitive data” and that Authy accounts weren’t compromised. Twilio is advising users to update their Authy apps on Android and iOS (the Authy desktop app has been discontinued).