Twilio’s Authy App Breach Exposes Millions of Phone Numbers

Twilio's Authy App

Jul 04, 2024NewsroomData Breach / Mobile Security

Cloud communications provider Twilio has revealed that unidentified threat actors took advantage of an unauthenticated endpoint in Authy to identify data associated with Authy accounts, including users’ cell phone numbers.

The company said it took steps to secure the endpoint to no longer accept unauthenticated requests.

The development comes days after an online persona named ShinyHunters published on BreachForums a database comprising 33 million phone numbers allegedly pulled from Authy accounts.

Authy, owned by Twilio since 2015, is a popular two-factor authentication (2FA) app that adds an additional layer of account security.

Cybersecurity

“We have seen no evidence that the threat actors obtained access to Twilio’s systems or other sensitive data,” it said in a July 1, 2024, security alert.

But out of an abundance of caution, it’s recommending that users upgrade their Android (version 25.1.0 or later) and iOS (version 26.1.0 or later) apps to the latest version.

It also cautioned that the threat actors may attempt to use the phone number associated with Authy accounts for phishing and smishing attacks.

“We encourage all Authy users to stay diligent and have heightened awareness around the texts they are receiving,” it noted.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

The post “Twilio’s Authy App Breach Exposes Millions of Phone Numbers” appeared first on The Hacker News

Source:The Hacker News – [email protected] (The Hacker News)