The Twilio Breach of 2022: How SMS Phishing Beat One-Time Codes

In August 2022 Twilio, the company whose software sends a large share of the world’s verification texts, admitted it had been breached by a text message. Attackers had sent Twilio employees SMS messages pretending to be from the IT department, collected their passwords on a fake login page, and used them to reach internal tools that could see customer data.

The irony was hard to miss. The company many businesses rely on to deliver one-time codes had been undone by the same kind of phishing those codes are meant to stop. The effects spread well beyond Twilio: into Authy, into Signal, and into a campaign that hit more than 130 organisations.

Four years on, the Twilio breach is still the clearest case study for any business that relies on a communications provider, and on SMS codes, to keep its accounts safe. Here is what happened and what it should change about how you work.

1. What Happened: The Timeline

Twilio was unusually open about this incident and published a final report when its investigation closed. The dates below come from that report unless noted.

The June incident is easy to overlook, but it matters. Twilio was breached by social engineering twice in six weeks, once by phone and once by text, and later attributed both to the same group.

2. How the Attack Worked

Nothing about the technique was novel. What made it effective was how well it was tailored.

1. The text. Employees received SMS messages that appeared to come from Twilio IT, saying their password had expired or their schedule had changed, with a link to “log in”. Some went to former employees too, which suggests the attackers had built their target list from public sources rather than from inside Twilio.
2. The link. Domains such as twilio-sso.com and twilio-okta.com looked plausible on a small phone screen.
3. The fake page. A convincing copy of Twilio’s Okta sign-in page captured the username, password and the one-time code, and relayed them to the attacker in real time, so the code was used before it expired.
4. The access. With a live session, the attackers reached internal administrative tools that customer support staff use, and from there viewed customer account data.

3. Who Was Affected: Twilio, Authy and Signal

Twilio customers. Twilio said attackers accessed data belonging to 209 of its more than 270,000 customer accounts, and that there was no evidence they had accessed customers’ console passwords, authentication tokens or API keys. The data viewed was mainly contact and account information.

Authy users. This is where it became more serious. Authy is Twilio’s two-factor authentication app. For 93 of its roughly 75 million users, the attackers registered an additional device on the account, which would let them generate that user’s login codes. Twilio removed the rogue devices and contacted the users.

Signal users. Signal used Twilio to send its phone number verification texts. Signal said the attackers could have seen the phone numbers or verification codes of about 1,900 users, and could potentially have re-registered those numbers on another device. It said the attackers explicitly searched for three numbers, and one of those users reported their account had been re-registered. No message history was exposed, because Signal doesn’t store it.

The lesson from the Signal case is that a breach at your communications provider can reach your customers even when your own systems are untouched. If you use SMS to verify people, the provider that sends those texts is part of your security.

4. Part of a Much Bigger Campaign: 0ktapus

Twilio wasn’t a one-off target. Researchers at Group-IB linked the attack to a campaign they named 0ktapus, which used the same phishing kit against more than 130 organisations and harvested close to 10,000 sets of credentials. Okta tracked the same activity as Scatter Swine. The group behind it later became widely known as Scattered Spider, which went on to cause major disruption at large casino and retail companies.

Among the other companies targeted in the same weeks were Cloudflare, DoorDash and Mailchimp. The contrast between them is the most useful part of the whole story.

5. The Company That Received the Same Texts and Was Fine

Cloudflare published its own account in August 2022. Seventy-six of its employees received the same style of text within a minute, pointing to a fake Okta page. Three employees entered their credentials.

None of them was breached. Every Cloudflare employee used a FIDO2 hardware security key, and a hardware key refuses to authenticate to a site that isn’t the real one. The stolen passwords were useless on their own. Cloudflare then blocked the phishing domain and traced the attacker’s infrastructure.

Twilio drew the same conclusion. Its remediation list after the incident started with rolling out FIDO2 security keys to every employee, alongside tighter VPN controls, reduced functionality in its internal admin tools, more frequent token refresh and mandatory social engineering training.

6. A Footnote: Authy Again in 2024

In July 2024 Twilio confirmed a second, unrelated Authy exposure. ShinyHunters, the group now behind the 2026 RingCentral breach, had fed millions of phone numbers into an Authy API endpoint that didn’t require authentication and published about 33 million numbers that came back as registered. No accounts were taken over, but the list was an obvious gift to SMS phishers. Twilio secured the endpoint and told users to update the app.

Two different flaws, two years apart, both ending with phone numbers in criminal hands. For businesses the point is the same: assume your staff’s mobile numbers are known, and don’t let an SMS code be the only thing protecting anything important.

7. What Australian Businesses Should Take From It

Most small and mid-sized businesses will never be targeted as precisely as Twilio was. But the same kit is sold cheaply and used widely, and phone system admin accounts are a favourite target because they lead straight to toll fraud. The practical lessons:

1. Use phishing-resistant MFA for anything important. Passkeys and FIDO2 keys are now supported by Microsoft 365, Google Workspace and most serious business platforms. Start with admins, finance and anyone with access to your phone system.
2. Stop relying on SMS codes for staff logins. They’re better than a password alone, but they are exactly what this attack was designed to defeat.
3. Train people for texts, not just emails. Staff are used to spotting email phishing. A text about their roster on a personal phone gets far less scrutiny.
4. Treat your comms provider as part of your security. If you send verification texts, or your phone system carries MFA codes, ask how that provider protects its own staff accounts.
5. Limit what support tools can see. Twilio’s attackers got in through support tooling. The same applies inside your business: help desk and admin accounts should see only what they must.

For the Australian regulatory side, including the Privacy Act and what to do if a provider’s breach exposes your customers’ data, see our phone system security and compliance guide. For the same attack pattern aimed at Cisco and its Webex meetings, see our Cisco and Webex breach analysis.

8. Questions to Ask Your Phone or SMS Provider

• Do all of your employees use FIDO2 keys or passkeys to access internal systems? If not, which staff don’t?
• What can your support staff see about our account, and is that access logged?
• If you send verification or MFA texts for us, how would you tell us if those messages were exposed?
• Can we enforce our own SSO and MFA policy on every user in our account?
• What protections do you have against number porting and SIM swap fraud on our numbers?

9. The Bottom Line

The Twilio breach wasn’t a failure of technology so much as a failure of the one assumption most businesses still make: that a password plus a one-time code is enough. It wasn’t for Twilio, and it won’t be for a business with a fraction of Twilio’s security budget.

The fix is known, affordable and proven. Cloudflare received the same texts in the same week and suffered nothing because it had already moved to hardware keys. If you take one action from this article, make it that one, starting with whoever can log in to your phone system.

Sources

• Twilio: Incident report, August 2022 social engineering attack
• Cloudflare: The mechanics of a sophisticated phishing scam and how we stopped it
• TechCrunch: Twilio hacked by phishing campaign
• The Hacker News: Twilio breach also compromised Authy two-factor accounts
• Okta Security: Detecting Scatter Swine
• SecurityWeek: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

Frequently Asked Questions

What happened in the 2022 Twilio breach?

In July and August 2022 attackers sent Twilio employees SMS messages pretending to be from the IT department, linking to a fake Okta login page. They used the harvested credentials and one-time codes to reach internal support tools and view customer data. Twilio detected the access on 4 August 2022 and disclosed it on 7 August.

How many customers were affected by the Twilio hack?

Twilio’s final investigation, closed on 27 October 2022, found that 209 of its more than 270,000 customer accounts had data accessed, and that 93 users of its Authy authenticator app had unauthorised devices added to their accounts. Signal separately said about 1,900 of its users’ phone numbers or verification codes may have been exposed.

What was the 0ktapus campaign?

0ktapus was the name researchers at Group-IB gave to the phishing campaign behind the Twilio breach. It impersonated Okta login pages and targeted more than 130 organisations, harvesting nearly 10,000 credentials. Okta tracked the same activity as Scatter Swine, and the group behind it became widely known as Scattered Spider.

Why was Cloudflare not breached by the same attack?

Cloudflare employees received the same phishing texts and three entered their passwords, but every Cloudflare employee used a FIDO2 hardware security key. A hardware key will not authenticate to a look-alike domain, so the stolen passwords could not be used to log in.

Are SMS one-time codes safe for business logins?

They are better than a password alone, but they can be phished. A fake login page can capture the code and relay it to the attacker before it expires, as happened at Twilio. For administrators and anyone with access to sensitive systems, including your phone system, passkeys or FIDO2 security keys are the recommended option.

Was Authy hacked again in 2024?

In July 2024 Twilio confirmed that attackers had used an unauthenticated Authy API endpoint to check which phone numbers were registered, and ShinyHunters published about 33 million numbers. No accounts were reported as taken over, but the list increased the risk of SMS phishing. Twilio secured the endpoint.