Twilio warns users of two-factor app Authy that ‘threat actors’ have their phone numbers

Twilio says someone obtained phone numbers associated with its two-factor authentication (2FA) service, Authy, like previously reported by TechCrunch. On a security alert on Monday, Twilio warns that “threat actors” may attempt to use stolen phone numbers to carry out phishing attacks and other scams.

The incident follows a 2022 data breach that occurred after a phishing campaign tricked employees into disclosing their login credentials. The attackers accessed data from 163 Twilio accounts and were able to access and register additional devices to 93 Authy accounts.

Twilio traced this breach to “an unauthenticated endpoint” that had already been secured. Last week, menace actor ShinyHunters published a list of 33 million Authy account phone numbers on the dark web. As pointed out by BeepingComputerThe threat actor appears to have obtained the information by inputting a huge list of phone numbers into the insecure Authy API endpoint, which would verify that they are associated with the application.

“We encourage all Authy users to remain diligent and raise awareness about the texts they are receiving,” writes Twilio. He adds that he “has seen no evidence that threat actors gained access to Twilio systems or other sensitive data” and that Authy accounts were not compromised. Twilio is advising users to update their Authy apps on Android and iOS (the The Authy desktop app has been discontinued).