Authy, a two-factor authentication app, reported a hacking incident that reportedly saw 33 million cellphone numbers being stolen.
Twilio, the developer of the app, stated that the incident remained limited but reminded users to stay diligent on possible phishing attacks.
Authy Hackers Steal Connected Phone Numbers on App
In a blog post, Twilio confirmed that the company detected threat actors who were able to collect data associated with Authy accounts. Phone numbers were the primary data that was collected due to an "unauthenticated endpoint."
The company also clarified that there is no evidence that the hackers obtained access via Twilio's systems or other sensitive data. Moreover, Authy accounts were not compromised by the hacking incident.
However, Twilio advised its users to remain vigilant and have heightened awareness of the text that they might receive. The phone numbers collected by hackers could be used to send out phishing and smishing attacks, the company warned.
Authy Hackers Claim 33 Million Phone Numbers Were Stolen
A post in a well-known hacking forum claimed to have been responsible for the hacking of Twilio. The account under the name ShinyHunters stated that it managed to obtain 33 million cellphone numbers from the attack.
Despite the company downplaying the incident, tech experts argued that it could still pose a great risk to Authy users. For instance, attackers could send out malicious messages to users, imitating the identity of Authy and Twilio.
In 2022, Twilio suffered a data breach when a group of hackers obtained access to the data of more than 100 company customers. Similar hackers launched a phishing campaign and managed to steal credentials from 10,000 employees from at least 130 companies.
Twilio has now advised its users to update their app to receive the latest security updates and bug fixes.
