So what exactly was breached related to customers....

Even in the Techcrunch article, they have not specified anything. Are these customers other businesses or regular users using Twilio apps like Authy?

If the 'hackers' got too deep into the systems they might create a big mess. Authy 2fa tokens are backed up on Twilio servers (opt-in) unlike Aegis/andOTP. If you lose access to your offline 2fa tokens (phone stolen/lost), Authy can re-send these token from their servers. Users need to wait 24-48 hours for the whole recovery process to be over.

https://support.authy.com/hc/en-us/articles/115012672088-Res... https://authy.com/phones/reset/?proceed=true