848,000 Twilio records priced at a quarter cent each while investors pay 45 times earnings

Two prices for the same customers

On Breach Forums, a hacker using the name Satanic has been offering 848,000 records billed as Twilio SendGrid customer data for $2,000, about a quarter of a cent each, in a listing that dates to April 2025 ¹³. Twilio reviewed a sample and says↗ that "to the best of our knowledge … we believe that none of this data originated from SendGrid" ¹. The platform it supposedly came from closed 28 September worth $44.07 billion, up from $21.55 billion at the end of 2025 ². Two prices for one customer base, and this week they collided.

The sample reads like a sales database

The advertised fields are the tell. Emails and phone numbers, sure, but also company revenue, operating income, employee counts, SEO performance, hosting providers, Cloudflare and Tranco rankings, and tech stacks down to the CMS, payment and CRM tools ¹. That is the schema of scraped B2B prospect lists, the kind enrichment vendors sell by the row, not the accounts of an email platform.

It is evidence for Twilio's denial, and a read CX Today's story does not attempt ¹. The date is the other miss: Hackread first published the claim on 3 April 2025↗ and later added the hacker's insistence that the data is authentic ³. The AI rally's first security test is a rerun.

HSBC's $14 against a $75 rally

Meta launched Muse, its AI agent, on 8 September; Twilio is up about 30% since and trades at 45.3 times next-year earnings ⁴. HSBC cut the stock to Reduce on 25 September with a $211 target↗: even a bull case of tenfold Muse users, 30% of them placing a five-minute call daily, yields about $49.2 million of revenue, roughly $14 a share, against a $75 gain since launch ⁴.

Shares fell 7.6% that day↗ and recovered to $286.98 by 28 September, above the 30-analyst consensus target of $263.04 ⁵⁶². Rosenblatt at $290 and TD Cowen at $300 hold the other side ⁵.

The drip at the edges

The week's real security item also missed the core. ReversingLabs detailed tw-pkgprobe-7731, an npm package posing as a Twilio bug-bounty probe↗ that in one version exfiltrated the credentials ACCOUNT_SID and AUTH_TOKEN; Twilio said the packages were removed and that it experienced no security incident ⁷. That joins 33 million Authy phone numbers and 12,000 call recordings spilled in 2024, neither a direct breach of Twilio's own infrastructure ¹. The core has held.

The underworld prices a Twilio customer at a quarter of a cent; the market pays 45 times earnings to trust the same pipe.

What settles it

No independent check has settled either camp: Twilio's sampling and the hacker's authenticity claim are almost 18 months old and unreconciled ¹³. Watch whether the next drip lands inside the core rather than at its edge, what Meta discloses about Muse usage, and the Q3 results guided to $1.50 billion to $1.51 billion of revenue↗ ⁶.