Authy (also known as Twilio Authy) is a two-factor authentication (2FA) mobile app. Originally released in 2012 by Authy Inc., the app was acquired by American communications firm Twilio in 2015. Authy provides online backup for security tokens, and users must register an account with a phone number prior to using the app. It supports the Android and iOS operating systems. In 2022 and 2024, Authy experienced data breaches involving user accounts and phone numbers.
History
Authy Inc. founders Daniel Palacio and Gleb Chuvpilo were accepted into the Y Combinator startup accelerator program in late 2011. The initial version of Authy was released in August 2012. In 2014, Authy Inc. raised $3 million in a series A round. At the time, Authy charged companies for its API, which allowed websites to validate each login with a one-time password (OTP) delivered to the user's device. Companies that implemented the API were billed every time a user signed up or logged in via Authy. Twilio acquired Authy Inc. in February 2015 and indicated that Authy would be integrated with Twilio's API.
Authy maintained a Chrome App and browser extension for Google Chrome from April 2014 until the deprecation of the Chrome App platform in 2020. The Windows and macOS desktop applications for Authy were released in 2017, followed by a beta version of the Linux application in 2020. Authy discontinued its Windows, macOS, and Linux applications in August 2024. Because Authy did not include a data export feature, users who switched to another two-factor authentication (2FA) app had to disable 2FA on each of their accounts before re-enabling it with the new app.
Security incidents
Twilio employees were targeted by an SMS phishing campaign in August 2022 that resulted in a data breach impacting 209 of Twilio's client organizations, after which the hackers compromised 93 Authy accounts and linked them to their own devices. In a July 2024 data breach, hacker group ShinyHunters used an unsecured Twilio API to collect the phone numbers of 33 million Authy accounts.
