Twilio Hack 2022: How SMS Phishing Breached Internal Systems and What Organizations Must Learn in 2026

Twilio recently uncovered a coordinated phishing attack that tricked employees into giving up credentials. Using targeted text messages, the attackers sent convincing alerts that mimicked IT messages, directing employees to malicious URLs. Here’s what happened and how Twilio responded.

Last Updated: 2026-05-20

Twilio’s Data Leak Reveals Sophisticated Phishing Attack on Employees

In the fast evolving world of cyber threats, phishing attacks remain a major risk, and recent events at Twilio, a leader in communication tools, underscore this reality. The San Francisco based company recently detected a data breach in which attackers gained access to employees’ credentials via carefully crafted phishing schemes. With these credentials, attackers entered Twilio’s internal systems, putting sensitive data at risk. This article explores the details of the breach, the attack methods, and key lessons for any organization aiming to protect its workforce from similar threats.

What Happened? The Incident Breakdown

The data leak surfaced when current and former Twilio employees began reporting suspicious text messages that appeared to come from Twilio’s IT department. The messages warned employees of “expired passwords” or changes in program access, urging them to log in to the “Twilio” platform through a specific URL. However, these URLs were controlled by attackers who designed a landing page that imitated Twilio’s legitimate login interface.

Upon further investigation, Twilio’s security team found that these URLs contained terms like “Twilio,” “Okta,” and “SSO” (Single Sign On) in an attempt to create a false sense of authenticity. This approach aligns with phishing best practices attackers use to deceive users and gather login credentials. Although Twilio acted quickly to shut down these URLs, the scale of the attack revealed highly sophisticated social engineering tactics.

Understanding the Attack Vector: SMS Phishing

SMS phishing, or smishing, leverages text messages to trick users into revealing confidential information or clicking on malicious links. Unlike traditional email phishing, smishing has a more personal touch because text messages often feel more urgent and immediate. Attackers in this case likely knew that Twilio employees would perceive messages about security updates or program changes as credible, especially coming from what seemed to be an internal source.

This incident at Twilio highlights the growing sophistication of smishing attacks. Twilio’s attackers reportedly gathered employees’ names and corresponding phone numbers, enabling personalized messages that increased the likelihood of engagement.

For organizations, the lesson is clear: As smishing attacks become more advanced, employee security awareness training must include scenarios that help them identify and resist these threats.

How Did Twilio Respond to the Attack?

Twilio quickly recognized the scale of the attack and took decisive action. Here’s an overview of the response:

Shutting Down Malicious URLs: Twilio collaborated with U.S. based carriers and hosting providers to block the distribution of text messages from known sources. They worked to identify and deactivate URLs associated with the malicious login pages, stopping additional employees from accessing the fake site.
Coordinating Industry Wide Response: Recognizing that other organizations were facing similar attacks, Twilio reached out to coordinate their efforts with other companies to mount a more effective defense. This collective action is becoming increasingly critical as cyber attackers target numerous organizations within the same industry.
Notifying Employees and Reinforcing Training: Employees were promptly notified, and Twilio took steps to reinforce security training. By educating employees on identifying smishing attempts and explaining the attackers’ use of specific terms like “Twilio” or “Okta” in URLs, Twilio aimed to reduce the likelihood of similar breaches in the future.

Lessons Learned from the Twilio Data Breach

While Twilio took swift action, the incident reveals valuable lessons that other organizations can leverage to better protect themselves.

1. Invest in Security Awareness Training

Training employees to recognize phishing attempts, especially smishing, is essential. Twilio’s incident demonstrates the attackers’ reliance on familiarity and urgency. Security training should cover tactics used in smishing and simulate phishing attacks, making employees aware of various scenarios they might face.

Security awareness training programs can provide employees with practical tools to respond to potential attacks. Through phishing simulations and interactive training, employees can practice responding to scenarios like the one at Twilio, gaining the skills to detect and avoid these traps.

2. Use Phishing Simulators to Test Employee Readiness

To prepare employees for real threats, phishing simulators offer a way to test responses in a controlled environment. Simulations help employees practice identifying malicious messages and make it easier to recognize potential threats in real situations. Regular phishing simulations help create a human risk score for your organization, allowing you to target training where it’s needed most.

Multi Factor Authentication (MFA) is one of the strongest defenses against unauthorized access, even if an attacker manages to capture user credentials. Twilio’s incident could have been mitigated if attackers encountered an MFA prompt that required additional validation. Implementing MFA across employee accounts and key platforms reduces risk and strengthens the organization’s security posture.

However, MFA alone isn’t enough. Monitoring for suspicious login activity, such as multiple login attempts from different locations or devices, can be crucial. This approach helps to catch potential security issues early, enabling a quicker response.

4. Coordinate Response with Other Organizations

In Twilio’s case, the company worked with other organizations to address the attack. Cybercriminals often target multiple companies with similar phishing schemes, as seen in the case of the Twilio incident. Building partnerships with other companies in your industry can be an effective strategy to counter coordinated attacks. Collaborative defense can bolster your security and improve response times, reducing the overall risk for each company.

5. Stay Updated with Threat Intelligence

Attack methods are constantly evolving, and staying informed about current threats is crucial. By using threat intelligence tools, organizations can gather real time information on emerging tactics, tools, and procedures used by attackers. Platforms such as the Keepnet Human Risk Management Platform allow companies to assess their current security posture and prepare for new threats, minimizing the likelihood of successful attacks.

Protecting Against Smishing: Practical Steps for Organizations

With smishing attacks on the rise, organizations should adopt comprehensive security practices. Here are a few actionable tips to protect employees from smishing:

Regularly Update Employees on Phishing Tactics: Keep employees informed about evolving tactics like those used in the Twilio breach, where attackers used recognizable terms like “SSO” and “Okta.”
Enable Secure Mobile Communication: Provide a secure channel for IT communication, so employees can verify messages and report suspicious content.
Encourage Reporting of Suspicious Messages: Employees should feel comfortable reporting unusual messages. Foster an environment where employees can ask questions about potential threats.
Restrict Employee Contact Information: Limit access to employees’ contact details to prevent attackers from gathering this data easily.

By combining training, technology, and threat intelligence, organizations can make it harder for attackers to execute similar attacks, reducing the risk of falling victim to smishing and other phishing schemes.

Editor's Note: This article was updated on May 20, 2026.

Schedule your 30-minute demo now

You'll learn how to:

Simulate smishing and phishing attacks to train employees on real-world scenarios.

Implement threat intelligence to identify and mitigate risks before they impact operations.

Monitor employee responses to phishing simulations, allowing for targeted training to close awareness gaps.

Frequently Asked Questions

What happened in the Twilio hack of 2022?

In August 2022, Twilio disclosed that attackers had gained unauthorized access to its internal systems and some customer data. The attackers sent SMS phishing messages to Twilio employees impersonating the company's IT department, directing them to fake login pages. Employees who entered their credentials gave attackers access to Twilio's internal tools. The attack was conducted by the Scatter Swine group (also tracked as 0ktapus), which used the same technique against over 130 organizations in the same campaign.

How is this Twilio incident different from the August 2022 breach reported separately?

Twilio experienced two related incidents in 2022. The first, in August 2022, involved SMS phishing of employees leading to unauthorized access to customer data. The second, sometimes reported separately, involved attackers accessing Twilio's Authy authentication app user data. Both incidents stemmed from the same underlying smishing campaign. This article covers the initial system access incident where employee credentials were harvested through fake IT department messages.

Why are smishing attacks on employees so effective?

Smishing attacks on employees are effective for several reasons: SMS messages bypass corporate email security filters; the condensed format of text messages makes URLs harder to inspect; employees are conditioned to act quickly on texts; and messages using internal company terminology, such as SSO or Okta, appear more credible. Unlike phishing emails which employees may have been trained to scrutinize, smishing exploits an awareness gap in most corporate security programs.

What is the Scatter Swine group and what is their method?

Scatter Swine, also tracked as 0ktapus, is a threat group that ran a large scale SMS phishing campaign in 2022 targeting technology company employees. Their method involved sending texts impersonating IT departments, directing targets to phishing pages that captured credentials and 2FA codes in real time. The harvested access was then used to breach the primary target or, in the case of Twilio, to access downstream customers. The group targeted over 130 organizations including Cloudflare, Signal, and DoorDash in the same campaign period.

What did Twilio do in response to the attack?

Twilio identified the attack when employees reported suspicious texts. The company worked with U.S. based telecom carriers and hosting providers to shut down the malicious URLs used in the phishing campaign. As attackers switched providers to continue operating, Twilio continued coordination efforts. Internally, Twilio revoked access for compromised employee accounts, notified affected customers, and enhanced monitoring for unauthorized activity. The company also published a detailed incident report, which became a useful resource for the security community.

How can MFA be bypassed in smishing attacks and what is the solution?

Standard MFA, including SMS codes and TOTP apps, can be bypassed through real time phishing: the fake login page captures the credential and 2FA code simultaneously as the victim enters them, then immediately uses them to log in to the real system. The solution is phishing resistant MFA, specifically FIDO2 hardware security keys or passkeys. These methods verify the authenticity of the login domain during the authentication process, so they produce no valid output on a fake phishing page, regardless of whether the employee enters their details.

What lessons should organizations take from the Twilio hack?

The primary lessons are: technical controls alone cannot stop a well executed smishing attack when employees are not trained to recognize it; standard MFA is insufficient against real time phishing and should be upgraded to phishing resistant methods; employees need specific training on SMS phishing, not just email phishing; and organizations providing authentication or communication services to other companies carry elevated risk because compromising them provides access to downstream customers. Keepnet's Smishing Simulator provides targeted training for exactly this attack vector.

What is threat intelligence sharing and how did it help in the Twilio incident?

Threat intelligence sharing involves organizations exchanging information about attack indicators, tactics, and infrastructure with each other and with law enforcement. In the Twilio incident, sharing indicators of compromise with other organizations helped identify the scope of the Scatter Swine campaign and allowed other targets to take defensive action more quickly. Twilio's public disclosure was itself a form of threat intelligence sharing that benefited the broader security community.

How can organizations train employees to recognize smishing?

Effective smishing awareness training should cover: what smishing messages look like and how they differ from legitimate IT communications; the correct procedure for verifying unexpected messages (contacting IT through an independent channel, not following the link); how to report suspicious texts; and why acting quickly on urgent messages is exactly what attackers want. Running regular SMS phishing simulations gives employees practice recognizing and reporting smishing attempts in a safe environment before they encounter real attacks.

What is a supply chain risk in the context of the Twilio breach?

Supply chain risk means that compromising one vendor can provide access to that vendor's customers. Twilio is a supply chain risk because it provides authentication and communications services to thousands of other companies. Once attackers accessed Twilio's systems, they could potentially intercept 2FA codes being sent to customers of Twilio's clients, access customer contact data, or use Twilio's messaging infrastructure for secondary attacks. Any organization that provides critical services to others must treat its own security as a responsibility that extends to its customers.