Article Details
Scrape Timestamp (UTC): 2024-07-04 03:43:32.326
Source: https://thehackernews.com/2024/07/twilios-authy-app-breach-exposes.html
Original Article Text
Click to Toggle View
Twilio's Authy App Breach Exposes Millions of Phone Numbers. Cloud communications provider Twilio has revealed that unidentified threat actors took advantage of an unauthenticated endpoint in Authy to identify data associated with Authy accounts, including users' cell phone numbers. The company said it took steps to secure the endpoint to no longer accept unauthenticated requests. The development comes days after an online persona named ShinyHunters published on BreachForums a database comprising 33 million phone numbers allegedly pulled from Authy accounts. Authy, owned by Twilio since 2015, is a popular two-factor authentication (2FA) app that adds an additional layer of account security. "We have seen no evidence that the threat actors obtained access to Twilio's systems or other sensitive data," it said in a July 1, 2024, security alert. But out of an abundance of caution, it's recommending that users upgrade their Android (version 25.1.0 or later) and iOS (version 26.1.0 or later) apps to the latest version. It also cautioned that the threat actors may attempt to use the phone number associated with Authy accounts for phishing and smishing attacks. "We encourage all Authy users to stay diligent and have heightened awareness around the texts they are receiving," it noted. Continuous Attack Surface Discovery & Penetration Testing Continuously discover, prioritize, & mitigate exposures with evidence-backed ASM, Pentesting, and Red Teaming.
Daily Brief Summary
Twilio disclosed an unauthorized access incident in its Authy app, revealing that attackers harvested millions of user phone numbers.
This security breach centers on an unauthenticated endpoint within Authy that attackers used to extract specific account data.
The incident follows a claim by an online entity, ShinyHunters, on the BreachForums that they possess a database containing 33 million numbers from Authy.
Twilio has since fortified the app's security, modifying the Authy endpoint to reject unauthenticated requests.
Despite the breach, Twile denied any evidence of penetration into their internal systems or theft of other sensitive data.
Twilio recommends that all Authy users promptly update their apps to the latest versions for enhanced security.
Users are also advised to be vigilant about potential phishing and smishing threats leveraging the exposed phone numbers.
Twilio continues to emphasize the importance of ongoing surveillance and proactive security measures in response to the incident.