Picture the message as it landed. A work notification on a personal phone, apparently from the IT department: your password has expired, sign in here to reset it. Or, for some recipients, a note that their shift schedule had changed, with a link to check it. The link went to an address with the company name and the words "sso" or "okta" in it, and the page it opened looked exactly like the sign-in screen staff used every day. That is how the Twilio hack began in the first days of August 2022. A few employees typed in their username, password and one-time code, the attackers used those details on the real system within seconds, and from there they reached the internal tools Twilio staff use to support customers. Twilio detected the intrusion on 4 August, and the last unauthorised activity was on 9 August. By the time the investigation closed, 209 customer accounts had been accessed, 93 users of the Authy authenticator app had strange devices attached to their accounts, and Signal, the encrypted messaging app, had told around 1,900 of its users that their phone numbers or registration codes may have been exposed. There was no zero day exploit and no malware on a server. There was a text message, a copied page and a code that proved much less than everyone assumed. This article walks through the chain link by link, because each link has a direct equivalent in an Australian small business, and most of them can be fixed in a month.