The cloud communications company behind the email delivery service SendGrid, Twilio,is facing fresh scrutiny following claims by a hacker using the alias “Satanic,” who alleges to have breached the platform and accessed sensitive customer data.
The hacker reportedly posted a sample of the purported stolen data on Breach Forums, a well-known cybercrime marketplace, and offered to sell the complete dataset—allegedly containing information on 848,000 SendGrid customers—for $2,000. The sample includes a broad range of personal and corporate information, raising concerns among cybersecurity professionals and affected organizations.
According to details shared on cyber news outlet Hackread, the leaked dataset appears to contain personally identifiable information (PII) such as email addresses, phone numbers, physical addresses, and social media profiles. Also included are LinkedIn IDs and internal company metrics like revenue, employee counts, hosting provider data, SEO performance, and tech stack components. Notably, the sample references prominent entities including Bank of America, Bazaarvoice, and the BBC.
Despite the gravity of the claims, Twilio has firmly denied any breach of its systems. In a statement to the media, a company spokesperson said, “There is no evidence to suggest that Twilio or Twilio SendGrid was breached.” The spokesperson added that after reviewing samples of the alleged data, the company believes “none of this data originated from SendGrid.”
The denial has done little to quell speculation, particularly given Twilio’s recent history of security incidents. In July 2024, the hacker group ShinyHunters leaked the phone numbers of 33 million users of Twilio’s Authy app, a widely used two-factor authentication tool. Two months later, a separate breach involving a third-party tool exposed approximately 12,000 call recordings from one of Twilio’s customers. While neither incident pointed to a direct compromise of Twilio’s core infrastructure, they contributed to mounting concerns over the company’s overall data security posture.
The hacker behind the current claim, Satanic, is not a newcomer to high-profile breaches. In September 2024, the same individual was linked to an attack on Tracelo, a smartphone geolocation tracking service, where the personal data of 1.4 million users was leaked. Within underground communities, Satanic is known for distributing infostealer logs and maintaining an active presence on platforms such as Telegram.
As of now, no independent verification has confirmed the authenticity or origin of the allegedly leaked SendGrid data. Cybersecurity experts continue to examine the samples and associated metadata to assess the potential source and impact. Twilio has not issued any updates beyond its initial statement.
