Updated 2 October 2026 to correct the date of the breach, which happened in 2022, not 2023, and to align the details with Twilio’s own incident report.
The Breach
In August 2022, Twilio, a major player in cloud communications, disclosed a significant data breach. According to Twilio’s incident report, from mid-July 2022 attackers sent text messages (smishing) to current and former employees, posing as Twilio IT and linking to fake login pages. Some employees entered their credentials, and the attackers used them to reach internal systems and customer data. Twilio detected the unauthorised access on 4 August 2022. Its investigation, concluded on 27 October 2022, found that 209 customers (out of more than 270,000) and 93 Authy end users had been affected. Twilio also disclosed a separate, smaller incident on 29 June 2022, in which an employee was persuaded over the phone (vishing) to hand over their credentials. Twilio linked the campaign to a group that researchers had tied to similar attacks on many other technology and telecommunications companies. The breach underlined the ever-increasing sophistication of social engineering tactics.
In-Depth Analysis
Social Engineering Tactics: The attackers’ use of smishing and vishing represents a trend towards more personalised and believable phishing methods. By impersonating Twilio’s IT staff, the attackers got around security measures that assume a valid login belongs to its owner, demonstrating the need for enhanced employee awareness and training in identifying such threats.
Scope and Scale of Impact: Though the breach affected a small fraction of Twilio’s customer base, its implications are far-reaching. The compromise of customer data can lead to loss of trust, legal consequences, and potential exploitation of affected individuals. For the affected Authy users, Twilio reported that the attackers had registered additional devices to their accounts, which it later identified and removed.
Financial and Reputational Costs
Direct Financial Costs: For any organisation in this position, immediate costs include the investigation, remediation, legal fees and potential fines. Long-term costs can involve enhanced security measures and increased insurance premiums.
Reputational Damage: Perhaps more damaging than the financial cost is the reputational hit. In a sector where trust is paramount, a breach can lead to a loss of customer confidence, potentially affecting market share and investor sentiment.
Why This Is an Insider Risk Problem
The attackers in this case were outsiders, but they worked through insiders: genuine employees, deceived into handing over genuine credentials. Once that happens, the activity that follows looks like an employee at work. That is why insider risk detection matters even when no employee intends any harm. Useful approaches include:
- Behavioural Analysis: Understanding what normal activity looks like for an account, so that departures from it stand out. For instance, an account suddenly reaching high-value data it has never used, at unusual hours or from an unfamiliar location, might indicate that the credentials are being misused.
- Anomaly Detection: Using AI and machine learning to identify unusual patterns in data access or account behaviour across platforms.
- Correlating Activity Across Applications and Systems: Bringing together activity from multiple sources gives a fuller picture. Patterns that look harmless in one system in isolation can stand out when viewed together.
The aim is visibility into how sensitive data is being accessed and where it moves, applied proportionately and transparently, not treating staff as suspects. Most employees caught out by a convincing phishing message have simply been deceived.
Mitigating the Risk
No single control stops social engineering. Organisations can reduce the risk and the damage with phishing-resistant multi-factor authentication, training that covers SMS and voice phishing as well as email, early detection of unusual account activity, and well-rehearsed response procedures so that a compromised account can be contained quickly.
In Summary
The Twilio data breach is a stark reminder of the evolving nature of cyber threats and the importance of insider risk management. It highlights the need for organisations to adopt a multi-layered security approach that includes robust employee training, insider risk detection and rapid response. As cyber threats continue to evolve, so must our strategies to combat them, with a focus on both the technological and human elements of cybersecurity.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.