Signal account re-registration via Twilio support console
Signal said on August 15, 2022 that the attacker who phished Twilio, its phone number verification provider, could see for about 1,900 users either that their number was registered to Signal or the SMS registration code. The attacker searched explicitly for three numbers, and one of those users reported that their account was re-registered to the attacker.
- Victim
- Signal
- Industry
- Technology
- Country
- United States
- Intrusion began
- Aug 2022
- First disclosed
- Aug 15, 2022
- Actor
- 0ktapus (via Twilio compromise) (Financially motivated)
- Initial access
- Third-party access
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 1,900 (About 1,900 users whose phone numbers or SMS verification codes may have been exposed, per Signal; one account was re-registered.)
- Disclosed cost
- Not disclosed
The identity lesson
SMS codes are only as safe as the telecom chain that delivers them; a PIN-based registration lock stops a stolen code from taking over the account.
Sources
- 1,900 Signal users exposed following Twilio breach, Help Net Security, Aug 16, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Cisco Duo SMS MFA logs stolen from a phished telephony provider 2024 · Third-party access
- Danish CPR register queried through a private company's abused access 2026 · Third-party access
- Commvault Metallic breach exposes Microsoft 365 app secrets 2025 · Third-party access
- LAPSUS$ access to Okta support via Sitel engineer workstation 2022 · Third-party access
Cite this record
SWI Community Team. (2026). Signal account re-registration via Twilio support console. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-signal-twilio-registration/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.