“Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint.”
Authy is a two-factor authentication app. Its maker left an endpoint open with no authentication, and 33 million phone numbers walked out with their account IDs. Twilio’s advice is to watch out for phishing texts. A security product leaked the exact list a phisher wants: people who protect valuable accounts, and their phone numbers.