Twilio breach via SMS phishing of employees
Starting in mid-July 2022, attackers sent Twilio employees SMS messages pointing to fake login pages and used the captured credentials to access internal systems; Twilio detected the access on August 4 and disclosed on August 7, 2022. The attackers used Twilio's internal tools to view data of 209 customers and 93 Authy users. Twilio also linked a June 29, 2022 voice phishing incident, in which an employee gave up credentials, to the same actors.
- Victim
- Twilio
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Aug 4, 2022
- First disclosed
- Aug 7, 2022
- Actor
- 0ktapus (Scatter Swine) (Financially motivated)
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 209 (209 customers (of more than 270,000) and 93 Authy users had data accessed, per Twilio's final update of October 27, 2022.)
- Disclosed cost
- Not disclosed
The identity lesson
Phishing-resistant authenticators such as FIDO2 keys defeat credential-harvesting sites; Cloudflare was hit by the same campaign and stopped it that way.
Sources
- Incident Report: Employee and Customer Account Compromise, Twilio, Aug 7, 2022
- The mechanics of a sophisticated phishing scam and how we stopped it, Cloudflare, Aug 9, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
- Workday CRM contact data taken in a social engineering campaign 2025 · Credential phishing
- Retool SMS phishing, deepfaked call and Google Authenticator cloud sync 2023 · Credential phishing
Cite this record
SWI Community Team. (2026). Twilio breach via SMS phishing of employees. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-twilio-sms-phishing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.