> someone was able to get into Twilio's Amazon Web Services S3 bucket, which was left unprotected and world-writable "Someone" was able? If the bucket was unpr

> someone was able to get into Twilio's Amazon Web Services S3 bucket, which was left unprotected and world-writable "Someone" was able? If the bucket was unprotected and world-writable, then _everyone_ was able. > 'non-malicious' > And judging from the URL involved, it appears to be an attempt to install a payment-card skimmer – RiskIQ has spotted the same URL in other S3 buckets targeted by miscreants. In what world is that non-malicious? Non-immediately-damaging _maybe_, but it seems clear that there was a malicious chain of reasoning involved. Twilio got super lucky if this is all that happened.