Documented incidentIncident 2022-08-04TwilioEngineering postmortem

SMS phishing of employees leads to compromise of Twilio customer accounts (2022)

Attackers used SMS phishing to fool some Twilio employees into giving up credentials, then used them to access internal systems and information about a limited number of customer accounts.

What happened

  • Twilio's early estimate of about 125 affected customers was later revised to 209 of more than 270,000 customers.Incident Report: Employee and Customer Account Compromise

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Audit trail missing actor, target or decisionAfter something goes wrong nobody can tell who or what took the action, on which object, or why.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Use phishing-resistant MFA for employeesHardware-key or passkey authentication resists lookalike-domain phishing that defeats SMS and one-time codes.
  • Limit and log internal console accessRestrict what an employee account can do in customer-account tooling and alert on unusual access.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern