how it happened
- whothreat grouphuge phone number list
- the gapunauthenticated endpointconfirmed Authy accounts
- the result33.4M phone numbersleaked
what everyone assumed
An endpoint that requires no authentication feels like it carries nothing worth protecting. It returns no passwords, no messages, no balances, just a yes or a no. Treating it as harmless is the reasonable read, because by itself it does almost nothing, and almost nothing is easy to leave alone.
what happened
The endpoint kept answering. Fed one number at a time, it confirmed or denied an account, which is unremarkable. Fed a very large list of numbers, one after another, it became something else: a way to sort the world’s phone numbers into Authy users and everyone else. The difference between safe and exposed was not the endpoint changing. It was the volume of questions, and nobody was counting the questions.
step by step
- an endpoint confirms whether a number has AuthyWithout authentication.
- a group feeds it a massive listNobody counts the questions.the assumption breaks here
- late June 202433.4 million numbers surfaceWith account IDs and device counts.
- 1 July 2024Twilio secures the endpoint
how it surfaced
A threat group fed it a massive list and kept what came back. In late June 2024 a file surfaced holding 33.4 million phone numbers tied to Authy accounts, along with account IDs and device counts. Twilio confirmed the access on July 1, secured the endpoint so it would no longer answer unauthenticated requests, and stated that no internal systems or other sensitive data were reached. The app built to protect logins had enumerated its own users’ numbers.
A read-only endpoint with no login is still a credential check if it confirms which accounts exist.
At scale, “is this a valid account” becomes a list, and the list is the exposure.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersSomeone checks a huge list of phone numbers and keeps the matches.what it costs youA list of your users' numbers ends up for sale.
- or it goes like thisit happenedDell, 2024howA partner lookup answers one order number after another, all day, for weeks.what leavesnames, addresses and orderswho ends up with ita seller on a criminal forum
- or it goes like thisit happenedTrello, 2024howAn 'is this email registered' check is fed a huge list of addresses.what leavesa list of your users with nameswho ends up with itbuyers of breach data
sources
your turn
what you can do about it
this week
List the endpoints that respond without authentication and ask one thing of each: if someone called it a million times, what would they have at the end.
Somewhere in your product there is probably an endpoint that answers a small question without asking who is asking: a lookup, a "does this email exist," a status check built for convenience. The Authy gap was that question, never asked of one helpful little route.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →