Reprinted from TidBITS by permission; reuse governed by Creative Commons
license BY-NC-ND 3.0. TidBITS has offered years of thoughtful commentary
on Apple and Internet topics. For free email subscriptions and access to the
entire TidBITS archive, visit http://www.tidbits.com/


      Hackers Claim to Have Stolen Phone Numbers of 33 Million Authy Users

   Adam Engst

   At TechCrunch, [1]Lorenzo Franceschi-Bicchierai writes:

     Last week, a hacker claimed to have stolen 33 million phone numbers
     from U.S. messaging giant Twilio. On Tuesday, Twilio confirmed to
     TechCrunch that 'threat actors' were able to identify the phone
     number of people who use Authy, a popular two-factor authentication
     app owned by Twilio.

   In a changelog post titled '[2]Security Alert: Update to the Authy
   Android (v25.1.0) and iOS App (v26.1.0),' Twilio said the breach was
   'due to an unauthenticated endpoint.'

   How are the app updates, whose release notes are limited to 'Bug
   fixes,' related to the breach? Apparently not at all, since Twilio told
   TechCrunch, 'We have seen no evidence that the threat actors obtained
   access to Twilio's systems or other sensitive data. As a precaution, we
   are requesting all Authy users to update to the latest Android and iOS
   apps for the latest security updates.'

   At least the breach acknowledgment wasn't at the bottom of a locked
   filing cabinet stuck in a disused lavatory with a sign on the door
   saying '[3]Beware of the Leopard.'

   Regardless, if you have an Authy account, be more alert to texts or
   calls from unknown parties, especially if they pretend to be from
   Authy. Not that it protected my phone number in any way, but I'm a
   little happier that I switched to 1Password for two-factor
   authentication (see '[4]Authy Desktop to Reach End-of-Life on 19 March
   2024,' 14 February 2024).

   [5]Read original article

References

   1. https://techcrunch.com/2024/07/03/twilio-says-hackers-identified-cell-phone-numbers-of-two-factor-app-authy-users/
   2. https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS
   3. https://www.goodreads.com/quotes/40705-but-the-plans-were-on-display-on-display-i-eventually
   4. https://tidbits.com/2024/02/14/authy-desktop-to-reach-end-of-life-on-19-march-2024/
   5. https://techcrunch.com/2024/07/03/twilio-says-hackers-identified-cell-phone-numbers-of-two-factor-app-authy-users/

.