Malicious actors have managed to steal more than 33 million phone numbers used by users of the two-factor authentication service Authy.
ADVERTISEMENT. Authy is a popular security application to manage authentication codes for apps and online services.
These add to the security of sign-ins, as the codes need to be entered in a second stage of authentication.
Twilio, Authy's parent company, confirmed the authenticity of the data and the hack to Bleeping Computer.
The company revealed that it has secured the endpoint used in the attack.
It furthermore released an update for Android and iOS as a precaution.
Authy customers cannot look up if their phone number is included in the leak.
There is no direct threat, as threat actors cannot do anything with the phone number alone.
The attackers could use online searches or other databases to link phone numbers to their owners.
Back in 2022, Twilio confirmed that it suffered a data breach.
If this reminds you of LastPass, a password management service that suffered through a series of hacks and issues in the last couple of years, you are not totally mistaken.
Migration is not straightforward, as Authy does not support exporting.
A workaround exists that uses an older version of the desktop app, but it may not work soon anymore as Authy is discontinuing the desktop program.
The only other option is to manually migrate the data.
Repeat the steps for any service and delete each of them once the migration completes.
This is done by long-tapping on the item in Authy and selecting the remove option.
As far as alternatives are concerned, check out my reviews of the open source authenticator Aegis or Bitwarden Authenticator.
Should you trust a service that suffered through several breaches in the past, or should you move to a service that has not.
LastPass customers have faced the same question several times in the past, and it is the same question that Authy customers should ask themselves.
It is inconvenient, thanks to the lack of proper export options.
This Cyber News was published on www.ghacks.net. Publication date: Thu, 04 Jul 2024 05:43:06 +0000