33 million phone numbers exposed in major Authy data breach
Authy is a popular third-party two-factor authenticator app that was acquired by Twilio (a San-Francisco based cloud communications company) in 2015. On 1st July 2024, Twilio confirmed in a blog post that customer phone numbers were leaked in a data breach associated with Authy. As per the post, the breach was caused by an "unauthenticated endpoint" that allowed attackers to identify phone numbers. An unauthenticated endpoint, for example, would be like a back door to a secure building that anyone could walk through without a authentication key. Twilio further assured its users that no passwords, two-factor authentication seeds, or other account details were compromised.
As of now, existing Authy users should be extra vigilant against potential phishing and smishing scams. These scams often involve attackers sending text messages or making calls impersonating legitimate companies in an attempt to steal login credentials or other sensitive information. While Twilio's blog post did not specify exactly how many accounts got affected, TechCrunch states that 33 million phone numbers were stolen. Reportedly, the hacker(s) ShinyHunters claimed responsibility for the attack on a hacking forum.
Twilio has also asked Authy users to promptly update the app (Android v25.1.0 or later, iOS v26.1.0 or later). Additionally, users are encouraged to be wary of unsolicited texts or calls requesting login information. For an extra layer of security, users can consider using a hardware key for two-factor authentication, or switch to a different app altogether, like Google Authenticator.
Source(s)
Twilio via TechCrunch
