Twilio, the company behind the two-factor authentication app Authy, was recently hacked, with the phone numbers of 33 million users compromised.
Authy hacked; phone numbers of 33 million users stolen.
Twilio confirmed in a blog post that "threat actors were able to identify data associated with Authy accounts, including phone numbers." The company attributed the issue to "an unauthenticated endpoint" and reassured users that it "has taken action to secure this endpoint and will no longer allow unauthenticated requests."
While Twilio didn’t specify how many users were affected, a group of hackers known as ShinyHunters claimed last week that they had stolen 33 million phone numbers from Twilio. Only after the hackers went public was the company forced to acknowledge the debacle. Since Twilio didn’t disclose the number in order to keep the severity of the situation under wraps, Authy users have no choice but to accept the number floating around.
However, Twilio has confirmed that nothing else was compromised: “We have seen no evidence that the threat actors gained access to Twilio's systems or other sensitive data.”
