Data from 2-factor authentication app Authy hacked

Cloud communications company Twilio says an unauthorized attacker gained access to users’ phone numbers from popular two-factor authentication app Authy. All of them, 33 million people information was stolen.

The person responsible for the invasion was a cybercriminal known as . Shiny HuntersThis could also be a hacker group. Last week it posted on private forums that it had access to phone numbers, but the company only now realised that the vulnerability had been exploited.

Data collected do not include other registration information and on their own, they are not even capable of compromising the security of accounts that use double-factor authentication.

However, with phones in hand, malicious actors can run phishing scams in a more sophisticated way, something known as “spear phishing” or “spear phishing.” For example, they might pose as Authy employees because they know the victim in question is a customer of the app.

What the company says

“Twilio detected that agents were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated access point. We have taken steps to secure this communication channel and are no longer allowing unauthenticated requests,” the company said in an official note posted on the app’s website.

Twilio has not confirmed to date what type of vulnerability was exploited. It also claims that: The company’s systems remain secure.

However, the developer recommends the following: Authy users for Android and iOS update their apps For the latest version on tablets and mobile phones.

HE This is the second year the company has been targeted by cyberattacks This leads to data theft. In a more serious crime in 2022, corporate customers’ credentials were accessed and some accounts were even accessed without permission.