Authy phone numbers enumerated through an unauthenticated endpoint
In late June 2024 ShinyHunters posted about 33 million phone numbers it said were tied to Authy accounts. Twilio confirmed attackers had identified data associated with Authy accounts, including phone numbers, through an unauthenticated endpoint, secured it, and urged users to update the Authy apps. Twilio said it found no evidence of access to its systems or other sensitive data.
- Victim
- Twilio (Authy)
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Jun 2024
- First disclosed
- Jul 1, 2024
- Actor
- ShinyHunters (claimed) (Financially motivated)
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Authentication
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
MFA providers are targets in their own right. An API that confirms whether a phone number has an account, without authentication or rate limits, hands attackers a list of people to SIM-swap or phish.
Sources
- Security alert: Authy app (Android and iOS), Twilio, Jul 1, 2024
- Twilio confirms data breach after hackers leak 33M Authy user phone numbers, SecurityWeek, Jul 4, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
- SimpleHelp RMM OIDC token forgery exploited for technician access 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Authy phone numbers enumerated through an unauthenticated endpoint. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-twilio-authy-unauthenticated-endpoint/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.