A hacker has reportedly leaked 12,000 Twilio call records along with phone numbers and audio recordings.
The cybersecurity-focussed online news platform Hackread shared the story and shed some light on the hacker who, it says, uses the alias ‘grep’.
grep has also claimed responsibility for two Dell data breaches this month that took place within a week of each other.
Yet, there is no evidence to suggest that the attack is a breach, Twilio has confirmed in a statement to CX Today.
"At this time, we have no evidence to suggest that Twilio was breached," said a Twilio spokesperson.
One of Twilio’s customers inadvertently exposed its own Twilio data when their developers used a third-party software tool that had a vulnerability. Twilio informed this customer and they’ve already taken steps to secure their account.
While Twilio's systems may have proven secure, the timing of the leak comes just a month after the CPaaS leader was sued for allegedly using its Segment SDK software to collect data without customer consent.
More Details on the Latest Alleged Attack
Hackread put the severity of the risk into context: "Although the leaked data by number is minimal, the presence of actual call recordings seriously increases the severity of the breach, as it exposes not just metadata but the contents of conversations.
"This can lead to serious privacy violations, especially if the calls involve sensitive personal or business information.
"Attackers could exploit these recordings for blackmail, fraud, or impersonation.
Businesses could face legal consequences under regulations like GDPR or CCPA for failing to protect this data.
The publication also explains that the leaked phone numbers are vulnerable to SMS phishing and voice call phishing scams, which are popular methods of attack for cybercriminals.
In 2022, Twilio fell victim to two phishing attacks, impacting at least 209 customers.
However, this time around, the hacker did not confirm that they had directly accessed Twilio’s systems.
