Business
Twilio says hackers identified cell phone numbers of two-factor app Authy users
Last week, a hacker claimed to have stolen 33 million phone numbers from U.S. messaging giant Twilio. On Tuesday, Twilio confirmed to TechCrunch that “threat actors” were able to identify the phone number of people who use Authy, a popular two-factor authentication app owned by Twilio.
In a post on a well-known hacking forum, the hacker or hackers known as ShinyHunters wrote that they hacked Twilio and obtained the cell phone numbers of 33 million users.
Twilio spokesperson Kari Ramirez told TechCrunch that the company “has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests.”
“We have seen no evidence that the threat actors obtained access to Twilio’s systems or other sensitive data. As a precaution, we are requesting all Authy users to update to the latest Android and iOS apps for the latest security updates and encourage all Authy users to stay diligent and have heightened awareness around phishing and smishing attacks,” Ramirez wrote in an email.
Twilio also published an alert on its official website on Monday, including the same statement.
While obtaining a list of phone numbers — on its own — may not appear to be the most dangerous of data breaches, it could still pose a threat to the owners of those numbers.
“If attackers are able to enumerate a list of user’s phone numbers, then those attackers can pretend to be Authy/Twilio to those users, increasing the believability in a phishing attack to that phone number,” Rachel Tobac, an expert in social engineering and CEO of SocialProof Security, told TechCrunch.
Tobac explained that now hackers can specifically target people who they know are Authy users, giving the attackers a chance to make it look like their malicious messages really come from Authy and Twilio.
In 2022, Twilio suffered a larger data breach, when a group of hackers accessed the data of more than 100 company customers. Armed with that information, the hackers then launched a wide-ranging phishing campaign which resulted in the theft of around 10,000 employee credentials from at least 130 businesses. As part of that breach at the time, Twilio said hackers successfully targeted 93 individual Authy users and were able to register additional devices on those victims’ Authy accounts, allowing them to effectively steal real two-factor codes.
-
Entertainment6 days ago
‘Girl Internet Show: A Kati Kelli Mixtape’ review: A loving homage to an internet oddity
-
Entertainment5 days ago
Why does the alt-right love interracial adult content so much?
-
Entertainment5 days ago
Samsung Galaxy S24 FE hands-on: How different is it from the Galaxy S24 Ultra I own?
-
Entertainment5 days ago
Emergency SOS on iPhone: What is it and how to use it
-
Entertainment4 days ago
What not to buy during Amazon’s October Prime Day sale
-
Entertainment4 days ago
Shark’s new FlexFusion wants to be your one and only hair-styling tool
-
Entertainment3 days ago
Cuffing season: what is it and how do you navigate it while single?
-
Entertainment2 days ago
'Pavements' review: A slanted, enchanting documentary-biopic-prank