Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Twilio confirmed that a threat actor used an unauthenticated Authy endpoint to identify phone numbers associated with Authy accounts. The attacker claimed to have obtained 33 million numbers, according to TechCrunch, but Twilio did not confirm that count. Twilio said it had secured the endpoint and had no evidence that the actor accessed its systems or other sensitive data.
Was Authy hacked?
In July 2024, Twilio disclosed that an unauthenticated endpoint could be used to identify phone numbers associated with Authy accounts. Twilio said it secured the endpoint and no longer allowed unauthenticated requests. The company also said it had no evidence that the threat actor accessed Twilio systems or other sensitive internal data, and said Authy accounts were not compromised in the incident. Twilio’s July 1, 2024 security alert
Twilio’s Trust Center notice describes the method: the actor tested millions of phone numbers to determine which were linked to Authy accounts, bypassing protections by using multiple IP addresses. The endpoint was used exclusively by Authy during device registration, not by Twilio business customers.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Were 33 million Authy phone numbers stolen?
That number was the threat actor’s claim, not a count confirmed by Twilio. TechCrunch reported on July 3, 2024 that the group ShinyHunters claimed to have obtained 33 million users’ phone numbers. The report says Twilio confirmed attackers had identified phone numbers associated with Authy, but Twilio’s official notices do not verify the group’s exact figure. TechCrunch’s report
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Twilio’s wording establishes that phone numbers tied to Authy accounts could be identified through the endpoint. It does not establish that 33 million records were confirmed stolen, that authenticator codes or tokens were taken, or that attackers accessed users’ accounts.
What Authy users should do
- Update the app. Twilio recommended installing the latest Authy version on Android or iOS. Its July 1 alert named Android v25.1.0 and iOS v26.1.0; follow the current update offered for your device rather than relying on those 2024 version numbers.
- Be wary of unexpected messages. An exposed phone number can make a person a target for phishing texts, also called smishing. Do not open unexpected links or provide verification codes in response to unsolicited messages. Verify the sender through a trusted channel. Twilio’s user guidance
- Respond to an unfamiliar device alert specifically. If Authy alerts you that a device you did not add has been added, Twilio’s support guidance is to remove that device, turn off the Multi-device setting, and change your Authy backups password. This is advice for an unrecognized-device alert, not a blanket requirement for everyone affected by the 2024 endpoint issue. Twilio’s New Device Added guidance
Twilio’s incident notice did not tell users to change their phone number, replace their phone, or buy a new device.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Authy desktop’s shutdown was a separate issue
Authy desktop apps for Linux, macOS, and Windows reached end of life on March 19, 2024—before the July phone-number disclosure. The desktop shutdown was a separate product change, not a consequence of the incident. Twilio says Authy does not provide a token-export feature. To move tokens to another authenticator app, users must re-enable two-factor authentication for each service and add the account to the replacement app. Twilio’s Authy Desktop end-of-life guide
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat Twilio’s current app terms say
Twilio’s Authy Application Terms, last updated February 23, 2026, say that on or after that date certain new users, as well as existing users who reinstall Authy or add it to another device, may have device ID, device information, and IP-derived location processed for fraud prevention and account security. The terms describe that data processing; they do not say it was caused by the 2024 incident. Twilio Authy Application Terms
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
