Trust Center

Developers often build applications with ready-made code components, called packages, downloaded from public registries such as npm, the largest public registry for JavaScript code. Anyone can publish to these registries, so a package's name doesn't prove who made it. Attackers increasingly publish packages, add-ons, and integrations that impersonate trusted vendors, including Twilio, to steal credentials and sensitive data from developer environments. These tools may claim to be "official" or "authorized" security or research tools. Twilio will never ask you to install a package, script, or tool from outside our official documentation to verify or secure your account.

We recommend the following practices:

Verify before you install. Check the publisher, source repository, version history, and download activity of any package, plugin, or integration. Install Twilio SDKs only from our official libraries page. Community-built libraries are not maintained by Twilio. On npm, check a package's provenance details and run npm audit signatures to verify the dependencies in your project.

Review install scripts. Be cautious of packages that run code automatically when installed, read environment variables, or make unexpected network calls.

Limit what a compromised package could steal. Use API keys scoped to the least access needed instead of your primary Auth Token. Environment variables keep credentials out of your code, but any package running in that environment can still read them. Keep production credentials out of environments where you install and test new packages, and rotate keys regularly. See Secure Your Twilio Account for more.

Scan continuously. Add dependency scanning and lockfiles to your CI/CD pipeline to flag suspicious or unexpected dependency changes.

Vet third-party integrations. Before connecting any tool to your account, including Twilio Marketplace listings, which are provided by third-party partners, confirm who built it and whether the access it requests is necessary.

Act quickly if something looks wrong. If you installed a suspicious package or shared credentials with an untrusted tool:

• remove it
• rotate your Auth Token and API keys immediately
• review your account activity
• contact Twilio Fraud Support.

Twilio Sendgrid is aware of 3rd party claims made on BreachForums. However, there is no evidence to suggest that Twilio or Twilio SendGrid was breached. After reviewing a sampling of this data, we believe that none of this data originated from SendGrid.

Twilio SendGrid recently discovered bad actors sent phishing emails impersonating Twilio Sendgrid containing fake SendGrid login links that may have led to those accounts being compromised.

What We’re Doing

As part of Twilio’s commitment to maintaining strong security practices, we have broken all known associated links related to this attack; while these links may be clickable, they are non-functional and may return a 404 Not Found error. Additionally, our teams are running forensics and will continue to investigate these phishing attacks and associated activity.

What You Should Do

Please remain vigilant and do not click on links from unexpected sources. Always verify the sender's identity before engaging with any message that contains links to ensure your online safety.

You may also want to take the following steps to ensure your account is secure:

• Reset Your Password and Set Up Two-Factor Authentication
• Cycle your account’s API keys
• Set up IP Access Management (if applicable)
• Review Twilio’s 10 Must-Follow Email Security Best Practices
• Review, update, and verify your teammates in your SendGrid account
• Review computers for malware and run anti-virus/anti-malware software

If you discover fraudulent content or links that were sent by a SendGrid customer, please report it to our team by forwarding it to abuse@sendgrid.com.

The Twilio Security Team recently detected that a threat actor was able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated API endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests.

There is no evidence of a breach of Twilio’s systems or other sensitive data.

Key Points:

• Twilio did not leak the bulk list of phone numbers. The threat actor tested millions of phone numbers to identify numbers associated with Authy accounts.
• They bypassed our protections using multiple IP addresses.
• The affected API endpoint is used exclusively by the Authy app during device registration and not by business customers. The API is now secure and does not allow requests from unvalidated mobile devices.

Action Required:

• Update your Authy app: Please update your Authy app to the latest Android and iOS app versions to receive the latest security updates.
• Stay vigilant: Although your Authy account is secure, threat actors might use associated phone numbers for phishing and smishing attacks. Be extra cautious and verify the legitimacy of any texts you receive.

Additional Resources:

CVE Publication

Twilio Changelog