Alleged Hacking Group Leader Behind Twilio, LastPass, & Mailchimp Breaches Arrested

Hackers deceived Twilio employees into sharing their login credentials, compromising customer data, and enabling access to some internal systems.

It is estimated that the attack affected approximately 125 Twilio customers.

The attack started when employees received text messages claiming to be from Twilio’s IT department. The messages instructed them to log in to a fake URL to update expired passwords, which gave the attackers their new credentials.

In response, Twilio’s security team revoked access to the compromised accounts, provided additional security training, and implemented further measures to prevent future attacks.

However, a few months later, it was revealed that the company had actually suffered an additional cyber-attack a few days prior, when a Twilio employee fell victim to a voice phishing (or "vishing") scam, allowing the hacker to access the contact information of a "limited number of customers."

In a statement released by Twilio, the company played down the extent of the hack:

The threat actor’s access was identified and eradicated within 12 hours. Customers whose information was impacted by the June Incident were notified on July 2, 2022.

However, some may wonder why Twilio did not immediately disclose this incident, unlike the data breach on August 4, which was addressed transparently with clear information and next steps.

Instead, Twilio mentioned this "brief security incident" at the end of the report for another attack, which seems less transparent.

With the alleged mastermind behind the attacks now in custody, it will be interesting to see whether any additional information regarding the attacks comes to light.

For more on the 2022 breaches, read our article: Twilio Confirms a Second Phishing Attack