Hackers abused API to verify millions of Authy MFA phone numbers

Twilio confirmed that an unauthenticated Authy API endpoint was abused to verify and compile ~33.42 million Authy-registered phone numbers, which were later leaked by the threat actor ShinyHunters; Twilio has secured the endpoint and released Authy app updates, advising users to be vigilant about smishing and SIM-swap attempts, and there is no reported evidence of broader system compromise.