Twilio says “threat actors” identified its 2FA app Authy users' phone numbers; last week, ShinyHunters claimed to have stolen 33M phone numbers from Twilio
It's not even about the data breaches - although important, Authy also sends data about which websites you're logging into. … X: Matthew Green / @matthew_d_green : The first rule of data breaches: if it exists in a database on the Internet, it will be stolen. The second rule of data breaches: the service that lost your data will be incredibly vague about exactly what the hackers took, because it's way worse than you imagine. @bleepincomputer : Twilio says that the API endpoint has now been secured and has released new versions of the Authy app. @bleepincomputer : An unauthenticated Authy API endpoint allowed threat actors to feed a massive list of phone numbers to the endpoint and verify if they are registered with the MFA platform. The threat actors claimed to verify over 33 million phone numbers (unconfirmed) used with Authy. Lorenzo Franceschi-Bicchierai / @lorenzofb : NEW: Hackers say they stole 33 million cell phone numbers of users of two-factor app Authy. Twilio (owner of Authy) confirmed “threat actors were able to identify” phone numbers, but didn't say how many. The risk is better tailored phishing attacks. https://techcrunch.com/... LinkedIn: Mirko Ross : 👻 Two-Factor-Authentifaction #2FA was yesterday... now we are moving into the decade of Three-Factor-Authentication #3FA to secure our access to applications... … Forums: Hacker News : Authy got hacked, and 33M user phone numbers were stolen r/plutus : Twilio alerts Authy two-factor app users that ‘threat actors’ have their phone numbers r/technews : Twilio says hackers identified cell phone numbers of two-factor app Authy users r/Bitwarden : Hackers exploit Authy API, accessing possibly 30 millions of phone numbers (and device_lock, device_count). Twilio takes action to secure endpoint. … r/cybersecurity : Twilio says hackers identified cell phone numbers of two-factor app Authy users | TechCrunch MacRumors Forums : Authy Users Urged to Stay Alert After Hack Exposes 33 Million Phone Numbers
Context & Ripple Effects
Twilio has previously tied Authy exposure to a wider staff-phishing incident: attackers accessed 93 users’ Authy accounts and registered devices in 2022, creating the possibility of generating their login codes in the affected cases. This incident instead centers on an unauthenticated API that revealed whether phone numbers were registered with Authy.
The distinction matters because the exposed registration data can make fraud attempts more credible even without account-code access. Twilio has secured the endpoint and issued updated Authy apps, but the episode adds another security event to Authy’s record after the earlier compromise of 93 Authy accounts.
First-order effects
- Authy users whose numbers could be matched to the service face a higher risk of tailored phishing that impersonates Authy or sites where they use two-factor authentication.
- Twilio must contain the exposed API behavior, distribute the updated app, and communicate clearly enough for affected users to recognize follow-on scams.
Second-order effects
- Organizations that rely on phone-based identity signals or Authy enrollment may need to warn users that knowledge of their Authy use can be exploited in social-engineering campaigns.
- The incident reinforces scrutiny of API endpoints that permit account or enrollment enumeration; security teams are likely to treat rate limits and authentication on such interfaces as part of abuse prevention, not merely application design.
Third-order effects
- Repeated exposure around a two-factor-authentication provider can weaken confidence in phone-number-linked MFA as a privacy-preserving control, even when the authentication codes themselves are not disclosed.
- If similar enumeration flaws continue to surface, MFA providers will be judged not only on code security but also on how much metadata their APIs reveal about users’ security posture.
The trend: Authentication security is expanding from protecting login codes to protecting the metadata that lets attackers identify and target protected users.