Hacker claims to have breached Twilio's SendGrid, selling data on 848,000 customers
Learn More
A threat actor using the alias "Satanic" is claiming to have breached SendGrid, the cloud-based email delivery platform owned by Twilio. The hacker announced the alleged breach on Breach Forums on Thursday, April 3, 2025, offering the purportedly stolen data for $2,000.
The database allegedly contains comprehensive information on 848,960 customers and companies. The sample data provided by Satanic includes:
- Customer contact information (emails, phone numbers, physical addresses, cities, states, countries)
- Social media profiles and LinkedIn IDs
- Company data (domain names, revenue, employee counts, SEO performance)
- Hosting provider information
- Rankings from services like Cloudflare and Tranco
- Financial metrics (revenue, operating income, net income)
- Employee data and executive details
- Technology stack information (CMS platforms, payment solutions, CRM tools)
The leaked information appears to be highly structured with dozens of metadata fields beyond basic contact information. Twilio has denied the breach claims. In a statement to Hackread, a Twilio spokesperson said:
"There is no evidence to suggest that Twilio or Twilio SendGrid was breached. To the best of our knowledge, after reviewing a sampling of this data, we believe that none of this data originated from SendGrid."
Twilio has experienced security incidents in the past year:
- In July 2024, hacker group ShinyHunters leaked a dataset containing 33 million phone numbers belonging to Twilio Authy users
- In September 2024, a separate breach exposed 12,000 call records through a third-party tool used by a Twilio customer
The authenticity of the current breach claim remains unverified, and Hackread is attempting to contact the hacker for further clarification. Security teams at potentially affected organizations may want to monitor the situation as it develops.
