Phishing attack exposes Signal users

Around  1,900 users of Signal, the encrypted messaging app, may have had their phone numbers or text verification codes accessed by hackers. 

The breach was part of a phishing attack on the communications company, Twilio, which provides Signal’s SMS verification service.

In a Twitter thread and support document, Signal states that a recent successful (and deeply resourced) phishing attack on Twilio allowed access to the phone numbers linked with 1,900 users. 

According to Signal no other data could be accessed. This is mainly due to Signal's design. Message history is stored entirely on user devices. Contact and block lists, profile details, and other user data require a Signal PIN to access. 

Signal is asking users to enable registration lock, which prevents Signal access on new devices until the user's PIN is correctly entered.

- CyberBeat