Objective
If you suspect that your Twilio SendGrid account has been compromised, it's crucial to act swiftly to secure your account and prevent any unauthorized access.
Product
SendGrid Email API, SendGrid Marketing Campaigns
User Account Permission/Role(s) Required
Primary administrator or Teammate with Administration permissions
Procedure
Immediate Actions
Change Your Credentials:
- Log in to your SendGrid account immediately.
- If yours is a SendGrid Legacy account, navigate to Settings > Account Details, and Change your password. Ensure that your new password is strong and unique.
- If yours is a Twilio Unified account, access your Twilio Console and change your password there. If you have subusers, and you believe they might have been compromised as well, change their passwords too, by going to Settings > Subuser Management, clicking the subuser's username, selecting their "Profile Settings" and clicking the Edit button in the password section.
- If you cannot access your SendGrid account due to a wrong password, please go to https://app.sendgrid.com/forgot_password, enter your username and change the password following the link on the email you will receive.
- If you cannot access your Twilio Unified account due to a wrong password, please change it following the steps of the "Resetting your Twilio Password" section in this support article: Unable to Log in to my Twilio Account
- Once you access the SendGrid UI, delete your API Keys and generate new API Keys
- It is also advisable to enable IP Access Management, so you can restrict the IPs that have access to the UI and can use your API Keys.
Update Integrations:
- If you delete and replace API keys, update your integrations with the new API Keys to resume sending emails as normal.
- If you have enabled IP Access Management, make sure that the IPs used by your integration have been added to the Allow list.
- Make sure that your integrations are safe as well, and running their latest versions.
Further Assistance
Contact Support:
If you need further assistance after changing your credentials, contact the Twilio SendGrid Support team. They can help isolate any issues or vulnerabilities with your SendGrid integration, delete any pending outbound emails, and even temporarily deactivate your account if necessary.
Compliance Team:
In some cases, our Compliance team may preemptively suspend accounts to prevent damage to your sending reputation and to reduce the amount of recipients getting fraudulent emails. If your account is suspended, check your email for notifications from the Compliance team and respond directly to work towards a resolution.
Additional information
- Always ensure your account credentials are secure and regularly updated.
- Monitor your account activity for any suspicious actions and report them immediately.