Category: UNCATEGORIZED

31 Jul 2020

Genomics startup Helix receives $33 million in NIH funding to scale COVID-19 testing

The U.S. National Institutes of Health (NIH) is revealing the first beneficiaries of its Rapid Acceleration of Diagnostics (RADx) program, and San Mateo-based Helix is on the receiving end of $33 million in federal funding as a result. Helix is a health tech startup founded in 2015 that focuses on insights derived from personal genomics, but the company has also developed a COVID-19 test that detects the presence of SARS-CoV-2 using RT-PCR methods.

The funding will be used to support Helix’s efforts to scale its COVID-19 testing efforts, with the aim of achieving a rate of 100,000 tests per day by this fall, and then extending the throughput capacity even further after that. Helix’s test got FDA Emergency Use Approval (EUA) earlier this month, and has since been available nationally across the U.S., promising “next day” results.

Helix was also filed for an EUA for a second type of test, an NGS test that offers higher throughput for more testing volume, as well as increased sensitivity towards actually detecting the presence of the virus to avoid false negatives. This test, if approved, will be key to helping Helix achieve that much greater scale of testing capability that is the ultimate aim of the RADx program.

That second test system currently seeking approval would be able to process as many as 25,000 tests per day, and it uses a different method that would also help reduce the strain on the supply chain.

31 Jul 2020

Working to understand Affirm’s reported IPO pricing hopes

News broke last night that Affirm, a well-known fintech unicorn, could approach the public markets at a valuation of $5 to $10 billion. The Wall Street Journal, which broke the news, said that Affirm could begin trading this year and that its IPO options include debuting via a special purpose acquisition company, also known as a SPAC.

That Affirm is considering listing is not a surprise. The company is around eight years old and has raised north of $1 billion, meaning it has locked up investor cash during its life as a private company. And liquidity has become an increasingly attractive possibility in 2020, when new offerings of all quality levels are enjoying strong reception from investors and traders who are hungry for equity in growing companies.


The Exchange explores startups, markets and money. You can read it every morning on Extra Crunch, or get The Exchange newsletter every Saturday.


But $10 billion? That price tag is a multiple of what Affirm was worth last year when it added $300 million to its coffer at a post-money price of $2.9 billion. There were rumors that the firm was hunting a far larger round later in 2019, though it doesn’t appear — per PitchBook records — that Affirm raised more capital since its Series F.

This morning let’s chat about the company’s possible IPO valuation. The Journal noted the strong public performance of Afterpay as a possible cognate for Affirm — the Australian buy-now, pay-later firm saw its value dip to $8.01 per share inside the last year before soaring to around $68 today. But given the firm’s reporting cycle, it’s a hard company to use as a comp.

Happily, we have another option to lean on that is domestically listed, meaning it has more regular and recent financial disclosures. So let’s how learn much revenue it takes to earn an eleven-figure valuation on the public markets by offering consumers credit.

Affirm’s business

Affirm loans consumers funds at the point of sale that are repaid on a schedule at a certain cost of capital. Affirm customers can select different repayment periods, raising or lowering their regular payments, and total interest cost.

Synchrony offers similar installment loans to consumers, along with other forms of capital access, including privately-branded credit cards. (Verizon, TechCrunch’s parent company, recent offered a card with the company, I should note.)  Synchrony is worth $13.5 billion as of this morning, making it a company of similar-ish value compared to the top end of the possible Affirm valuation range.

31 Jul 2020

Working to understand Affirm’s reported IPO pricing hopes

News broke last night that Affirm, a well-known fintech unicorn, could approach the public markets at a valuation of $5 to $10 billion. The Wall Street Journal, which broke the news, said that Affirm could begin trading this year and that its IPO options include debuting via a special purpose acquisition company, also known as a SPAC.

That Affirm is considering listing is not a surprise. The company is around eight years old and has raised north of $1 billion, meaning it has locked up investor cash during its life as a private company. And liquidity has become an increasingly attractive possibility in 2020, when new offerings of all quality levels are enjoying strong reception from investors and traders who are hungry for equity in growing companies.


The Exchange explores startups, markets and money. You can read it every morning on Extra Crunch, or get The Exchange newsletter every Saturday.


But $10 billion? That price tag is a multiple of what Affirm was worth last year when it added $300 million to its coffer at a post-money price of $2.9 billion. There were rumors that the firm was hunting a far larger round later in 2019, though it doesn’t appear — per PitchBook records — that Affirm raised more capital since its Series F.

This morning let’s chat about the company’s possible IPO valuation. The Journal noted the strong public performance of Afterpay as a possible cognate for Affirm — the Australian buy-now, pay-later firm saw its value dip to $8.01 per share inside the last year before soaring to around $68 today. But given the firm’s reporting cycle, it’s a hard company to use as a comp.

Happily, we have another option to lean on that is domestically listed, meaning it has more regular and recent financial disclosures. So let’s how learn much revenue it takes to earn an eleven-figure valuation on the public markets by offering consumers credit.

Affirm’s business

Affirm loans consumers funds at the point of sale that are repaid on a schedule at a certain cost of capital. Affirm customers can select different repayment periods, raising or lowering their regular payments, and total interest cost.

Synchrony offers similar installment loans to consumers, along with other forms of capital access, including privately-branded credit cards. (Verizon, TechCrunch’s parent company, recent offered a card with the company, I should note.)  Synchrony is worth $13.5 billion as of this morning, making it a company of similar-ish value compared to the top end of the possible Affirm valuation range.

31 Jul 2020

Recruiting for diversity in VC

Like many industries with a high concentration of wealth — and the careers that help professionals accumulate it — investment firms have a severe dearth of diversity in their ranks.

Regardless of whether the focus is venture capital, private equity or any other investment asset class, the firms are replete with white men. Though there have been some modest efforts of late to push for diversity, particularly in VC, these have yielded single digit percentage changes at best — and nothing at worst. Only 9% of investment decision makers in VC today are women; just 2% are Black.

Some firms have made reasonable inroads on this problem with good intentions. Based on my search experience recruiting investment professionals, I would guess that at least half of those searches were for clients with a strong preference to hire a “diverse” candidate. The Black Lives Matter movement has recently advanced the dialogue even further and has shined a light on underrepresentation in VC more than ever. “How do we increase our pipeline of diverse candidates?” is a question I heard frequently before 2020, but in past weeks this has become a chorus. Unfortunately, if solving this problem were as easy as telling a recruiter you want more diversity, it might have been solved long ago.

Below are a few common pitfalls we see in our searches with VC firms in particular, as well as some thoughts on how firms can improve their hiring processes, in order to work toward having more diverse representation within their investing teams.

Job description: Great comes in many forms

The most common reason I see for hiring processes leading to a slate with primarily white male candidates is because the criteria my client views as required almost completely precludes the possibility that the candidate slate will be diverse.

Taken as a given that women and minority men are not well-represented at senior levels in VC, any job spec that asks for a candidate to have seven to 10 years of experience in the industry, or a large number of board seats or investments led, will mean that the pool of “qualified” candidates will consist of mostly white men. This has historically been referred to as the “pipeline problem” and it’s an increasingly well-studied concept that academic literature is beginning to point to as a bias that pushes the onus of hiring minorities away from the hiring manager and on to the candidate pool. Even for firms that remain committed to hiring underrepresented groups without making adjustments to their criteria, the result is a zero-sum game where proven minority investors rotate from firm to firm, and an outcome that does not increase diversity in the industry as a whole.

VC firms seeking to improve their diversity have to recognize that great comes in many forms. By crafting broader specs and really thinking about the qualifications for their investing roles, a whole new talent pool opens up. To see that new pool of talent though, firms must first determine what characteristics are relevant to the role, and avoid tenure (or other tenure stand-ins) as the main criteria. VC investing is as much an art as a science; firms should decide what personal traits make somebody strong in their organization and why. How would a different viewpoint be additive to sourcing or diligence discussions?

Firms then need to commit to interviewing for those traits and perspectives, and assessing candidates along those same lines. One VC firm I worked with interviewed dozens of candidates before they realized that their process focused too much on financial acumen and not enough on the other factors they felt would make somebody a strong venture capitalist, resulting in a final slate of safe, “qualified,” and mostly nonminority candidates.

We reworked our process, and theirs, to interview for different criteria moving forward. We asked about overcoming hardships and about risks taken, and we got a sense for what type of impact that person made in whatever organization they came from rather than just asking about deals and transactions. It should be no surprise that the candidates with noninvesting backgrounds are performing much better in the process now, and the value they’d add to the organization more clear, even though the interviewers and the roles are the same.

Affinity bias: Go beyond what’s familiar

A broad spec and a team committed to hiring diverse talent, and interviewing appropriately, are great starting points. But then there is much more to do. Affinity bias is a well-known phenomenon that many investors are likely aware of, but it is pernicious in hiring settings and can be a serious challenge to overcome. Affinity bias in hiring is when a person or group of people prefer a candidate who looks, talks, acts or has a similar background to them.

In the case of hiring candidates with diverse backgrounds, affinity bias may be the tallest hurdle. In VC, the job is in many ways to seek common ground with the people you talk to. Good VCs are relationship builders — with entrepreneurs, other VCs and strong executives they want to recruit into their portfolio companies. But most investors are white people from affluent communities who attended elite universities and have worked at top-tier banks or consulting firms. In some cases there may have been a stint at another top-tier institution, be it a technology company or another investment firm.

White men are more likely to have these backgrounds. In a hiring process, white male VCs will naturally find ways to connect with candidates with similar backgrounds (i.e., other white men), in contrast to candidates with none of those same experiences, even when the candidates with other backgrounds are equally qualified for the role.

Affinity bias can be very subtle. It is human nature to feel the conversation was easier with somebody who in many ways has led the same life you did. It can feel somewhat logical even: The critique of the nonwhite or nonmale candidate is never as obvious as “They didn’t go to Stanford” or “They don’t belong to my country club.” Rather, it is often expressed as something softer and subjective — a seldom-articulated criteria of cultural fit. “Our culture is different from the place they work” is the most common. “I’m not sure they have the drive” is another, or “They don’t have an X-factor.” Now, these critiques can be completely legitimate.

A candidate may indeed be a bad fit for the culture of the firm because, for example, their prior employer was a gigantic corporate machine reliant on extraneous processes and they are interviewing for a role at a small entrepreneurial organization. But sometimes, particularly when interviewing candidates from different backgrounds, culture fit is a mask for affinity bias, and VCs (like all interviewers) need to be conscious of this tendency.

Look in the right networks

Investment firms almost always try to make a hire through their own network before leading a full search, and even before posting a job as being open anywhere online. This has become such an ingrained behavior that it is often discussed as a best practice. Unfortunately, “hiring through our network” almost certainly means the slate of candidates that a firm considers at the outset is going to be heavily nondiverse. Unless a firm (or to broaden this guidance, an organization) is already diverse across multiple vectors, then beginning a search by canvasing the firm’s own network is highly unlikely to yield a “diverse” candidate. This seems innocuous but it can actually be harmful to the odds that the firm ever hires a candidate from an underrepresented group. Why? There is another bias at work, the status quo bias.

Studies have shown that people tend to make choices that favor the status quo. Creating a balanced slate of choices is critical to avoid disfavoring minority candidates inadvertently. One study showed that having multiple women or Black candidates on a finalist slate increased the odds that the selected would be a minority by 70x-100x. But if a group of interviewers meets five white men through their networks before they meet anybody else, it is going to take an disproportionate number of underrepresented minority candidates to overcome the group’s bias toward hiring the “status quo” of the white men they met at the outset of the search.

At True Search, we recently audited one of our own searches to look for candidate-selected markers of their identity. We compared our pool of candidates to the NVCA diversity data from 2018. Compared to the industry averages, our pool of candidates was half as white and twice as female as the industry at large. I am not sharing that data as an advertisement for True Search, and in fact we strive to do more and are working on multiple programs to increase our networks with diverse candidate pools. The point is, when a VC firm uses a search firm or any outside consultant for a search, the pool of candidates is going to be much more diverse than if that VC firm simply calls up the people in their network, who probably are not all that diverse.

Focus on inclusion

A commitment to hiring more talent with underrepresented backgrounds is great; actually doing it is even better. Many studies have shown that diversity improves the performance of a team, but the onus is on the organization to foster an environment where those viewpoints are appreciated. In my discussions with VCs who are minorities, they point out that once they are in the door of the firm they still face challenges that white male colleagues don’t.

They are less likely to have mentors who share their backgrounds, and investing is largely an apprenticeship business. If they did not come from Stanford or Harvard, they are less likely to see deals that come through the sorts of personal networks that the firm is likely accustomed to seeing. If they came from a noninvesting background, they may be taken less seriously when presenting investment ideas to the team of career investors. A firm has to support diversity of thought once it is in the door, or the contributions of those team members may be unappreciated.

Firms can do many things to foster strong talent from diverse backgrounds once they are in the organization. Minority investors have shared some great ideas with me as I was thinking through this article, so these suggestions aren’t just my own. Underrepresented groups have historically (in the short history of such groups having any significant representation in the investing world) formed mentorship networks that transcend the walls of a given firm, such as Latinx VC, BLCK VC and All Raise.

VC firms should build as much connectivity with those sort of networks as possible. This will not only increase the odds that a firm will see more candidates from underrepresented groups, but it will also mean that the firm can play a role in finding strong mentors for their diverse talent throughout their career. Those networks can be built through small individual actions like attending and sponsoring events, or sharing job postings in the firm and portfolio with those networks.

VC firms can also help to jump-start a hire’s network in venture. Imagine a scenario where a firm hires a noninvestor with a unique yet amazing background into an investing role. Their peers all went to Stanford or worked at Facebook and are sourcing their deals through those personal networks. VC firms can use their resources to help close that network gap, such as by setting aside small pools of capital for a seed fund to be deployed by new investors with diverse backgrounds, thereby giving them a boost in early network building. I’ve seen firms deploy this strategy as a way to keep tabs on high potential operators, or on partner-level candidates they want to get to know more before they commit to hiring full-time.

Firms can help train junior talent and better prepare them for future full-time roles in venture by running intern or analyst programs and emphasizing the hiring of underrepresented groups into those roles. Even a part-time gig in VC will give a candidate a leg up in future interview processes, and even if that person goes off to another firm for a full-time role, the network back to that person will remain and could be helpful as a source of (or mentor to) the diverse talent the firm hires in the future.

31 Jul 2020

Opportunities (and challenges) in church tech

Americans are rapidly becoming less religious. Weekly church attendance is falling, congregations are getting smaller or even closing and the percentage of Americans identifying as “religiously unaffiliated” has spiked.

Despite all this, now might be the perfect time for church tech companies to thrive.

A combination of COVID-19-induced adoption, underrated demographic trends and pressure to innovate is setting the stage for new successes in the previously sleepy church tech space. Venture dollars are flowing in, and Silicon Valley is slowly showing serious interest in the sector. Hot new startups are finding creative growth hacks to penetrate a difficult market. Major challenges remain for companies in this space, but their odds seem better than ever.

Less religion, more spirituality

Yes, Americans are going to church less often, but that doesn’t mean they’re not staying spiritual. In fact, the percentage of Americans identifying as “spiritual but not religious” has grown faster than any other group in this Pew survey on religiosity. This fact is reflected in other data. For example, the percentage of Americans that pray daily or weekly has stayed fairly flat even as overall religiosity declined. This opens up two distinct opportunities, as well as two challenges.

Opportunities:

  • What tools do the growing “spiritual but not religious” crowd need?
  • Churches are realizing they need to innovate or die. What tools do they need to reach out to their members and gain new congregants?

Challenges:

  • Two demographics: young, tech-savvy and more willing to try a new product, but less involved in church tradition versus older, not as tech-savvy and harder to reach.
  • Very byzantine market: as documented in part one of this series, the market is dominated by small companies waging a turf war with one another. In addition, because churches are so local and hard to sell to, all of the companies to date have been smaller land-grabs rather than anything with scale or accumulating advantage.

Rapidly growing startups in the space are deftly navigating this landscape and taking advantage of these trends.

31 Jul 2020

Last day for early bird savings to Disrupt 2020

It’s officially now o’clock startup fans. All good things come to an end, and today’s the last day you can score an early bird pass to Disrupt 2020. Don’t miss your chance to save up to $300 and get busy building your business at our global Disrupt event. Buy your pass before the deal — and the savings — expires at exactly 11:59 p.m. (PT) tonight.

Disrupt 2020 takes place September 14-18. It’s packed with non-stop programming and gives you five full days to explore — expand your knowledge, your network, your opportunities and your business.

We’ve added a new event this year: The Pitch Deck Teardown. Expert VCs and entrepreneurs will assess pitch decks submitted by registered Disrupt attendees, note red flags and offer constructive advice on how to improve this essential startup tool. We’ll hold multiple sessions over the course of Disrupt, so if you’re a registered Disrupt attendee, submit your pitch deck for consideration.

That’s just one of many exciting ways attending Disrupt can help your early-stage startup survive and thrive. Exploring the hundreds of early-stage startups exhibiting in Digital Startup Alley is a great place to start. Connect with founders around the world, increase your brand recognition, discover people and technologies that can augment your business.

“The top three benefits of going to Disrupt were introducing my product to people who would not have seen it otherwise; networking with investors, mentors, advisors and potential customers and, finally, talking to other entrepreneurs and founders and learning what it took to get their companies off the ground.” — Felicia Jackson, inventor and founder of CPRWrap.

Remember, you have five days to experience Disrupt, so don’t miss the impressive lineup of speakers who span the startup universe. You’ll hear the latest thinking from top tech, investment and business icons, leaders, movers, shakers and makers. We’ve also announced the agenda here and we’re adding more to the roster every week.

Okay, let’s review. What time is it? It’s NOW o’clock — time to register for Disrupt 2020, save up to $300 and do whatever it takes to drive your business forward. Buy your pass before the early bird deal expires at 11:59 p.m. (PT) tonight!

Is your company interested in sponsoring or exhibiting at Disrupt 2020? ContTime is running out to save up to $300 on Disrupt 2020 passes. Get yours now!act our sponsorship sales team by filling out this form.

31 Jul 2020

The iron rule of founder compensation is dead

Hello and welcome back to Equity, TechCrunch’s venture capital-focused podcast (now on Twitter!), where we unpack the numbers behind the headlines.

We had the full team this week: Myself, Danny, and Natasha on the mics, with Chris running skipper as always.

Sadly this week we had to kick off with a correction as I am 1. Dumb, and, 2. See point one. But after we got past SPAC nuances (shoutout David Ethridge), we had a full show of good stuff, including:

And that’s Equity for this week. We are back Monday morning early, so make sure you are keeping tabs on our socials. Hugs, talk soon!

Equity drops every Monday at 7:00 a.m. PT and Friday at 6:00 a.m. PT, so subscribe to us on Apple PodcastsOvercastSpotify and all the casts.

31 Jul 2020

Amazon gains FCC approval for Kuiper internet satellite constellation and commits $10 billion to the project

Amazon has received approval from the U.S. Federal Communications Commission (FCC) to launch and operate a planned constellation of 3,236 internet satellites. That’s the backbone of Amazon’s Project Kuiper, an initiative to create a satellite-based broadband internet service designed to provide high-speed, low latency connections to U.S.-based households that currently don’t have great access to a high-speed connection.

Alongside the key regulatory approval, Amazon also announced that it would be committing over $10 billion in Kuiper, money that it says will generate U.S. jobs and involve not only building and testing satellites for the constellation, but also building out key ground network infrastructure that’s required in order to actually make the connectivity available to consumers.

Amazon’s Kuiper includes plans to provide backhaul service to carriers in addition to direct consumer service. Essentially, that means it’ll offer a way for carriers to offer high-speed LTE and 5G wireless connections to their customers in more areas where they don’t currently have the ground station infrastructure to do so. Amazon says this will be on offer “in the United States and around the world,” so it sounds like the plan is to first address the U.S. market and then expand the Kuiper network globally from there.

Amazon lags behind SpaceX in terms of deployment, since the latter company is actually launching satellites for its Starlink network, and looks ready to enter a beta testing program for the service this summer. The Jeff Bezos -led e-commerce giant has opened a brand new R&D facility in Redmond, Washington dedicated entirely to Kuiper development, however, and partner Blue Origin, Bezos’ space launch company, has been securing significant industry partnerships and could be ready to provide launch services for Kuiper satellites relatively soon.

It’s also unlikely that this emerging market for low Earth orbit satellites will have only one winner; provided these networks can actually live up to their promises in terms of latency, speed and quality connection, there will likely be room for multiple providers to compete on a global scale. Amazon’s $10 billion investment is also another good reason to bet it’ll be able to make this a reality – few others out there have as reliable a funding pipeline for the massive upfront infrastructure costs that come with launching a large satellite constellation.

31 Jul 2020

Twitter finally bans former KKK leader, David Duke

Twitter has confirmed it has permanently banned the account of David Duke, former leader of white supremacist hate group the Ku Klux Klan.

Duke had operated freely on its platform for years — amassing a following of around 53k and recently tweeting his support for president Trump to be re-elected. Now his @DrDavidDuke account page leads to an ‘account suspension’ notification (screengrabbed below).

A Twitter spokesperson confirmed to TechCrunch that the ban on Duke is permanent, emailing us this brief statement:

The account you referenced has been permanently suspended for repeated violations of the Twitter Rules on hateful conduct. This enforcement action is in line with our recently-updated guidance on harmful links.

While the move has been welcomed by anti-nazis everywhere, no one is rejoicing at how long it took Twitter to kick the KKK figurehead. The company has long claimed a policy prohibiting hateful conduct on its platform, while simultaneously carrying on a multi-year journey toward actually enforcing its own rules.

Over the years, Twitter’s notorious passivity in acting on policy-defined ‘acceptable behavior’ limits allowed abuse and toxic hate speech to build and bloom essentially unchecked — eventually forcing the company to commit to cleaning up its act to try to stop users from fleeing in horror. (Not a great definition of leadership by anyone’s standards as we pointed out back in 2017.)

Roll on a few more years and Twitter has been slowly shifting up its enforcement gears, with a push in 2018 toward what CEO Jack Dorsey dubbed “conversational health“, and further expansions to its hateful conduct policy. Enforcement has still been patchy and/or chequered. But appears to have stepped up markedly this year — which kicked off with a ban on a notorious UK right-wing hate preacher.

Twitter’s 2020 enforcement mojo may have a fair bit to do with the pandemic. In March, with concern spiking over COVID-19 misinformation spreading online, Twitter tweaked its rules to zero in on harmful link spreading (aka “malicious URLs” as it calls them), as a step to combat coronavirus scammers.

So it looks like public health risks have finally helped concentrate minds at Twitter HQ around enforcement — and everyone (still) on its platform is better for it.

In recent weeks Twitter has cracked down on the right-wing conspiracy theory group, Qanon, banning 7,000 accounts earlier this month. It also finally found a way to respond to US president Trump’s abuse of its platform as a conduit for broadcasting violent threats and trying to stir up a race war (and spread political disinformation) by applying screens and fact-check labels to offending Trump tweets.

The president’s son, Donald Trump Jr, has also had temporary restrictions applied to his account this month after he shared a video which makes false and potentially life-threatening claims about the coronavirus pandemic.

That looks like a deliberate warning shot across Trump’s bows — to say that while Twitter might not be willing to ban the president himself (given his public office), it sure as hell will kick his son into touch if he steps over the line.

Twitter’s policy on link-blocking states the company may take action to limit the spread of links which relate to a number of content categories, including terrorism, violence and hateful conduct, in addition to those pointing to other bad stuff such as malware and spam. The policy further notes: “Accounts dedicated to sharing content which we block, or which attempt to circumvent a block on the sharing a link, may be subject to additional enforcement action, including suspension.”

Twitter had previously said Duke hadn’t been banned because he’d left the KKK, per the Washington Times. So it looks as if he got the banhammer for essentially being a malicious URL node in slithering human form, by using his account to spread links to content that preached his gospel of hate.

Which makes for a nice silver lining on the pandemic storm cloud.

Much like similar right-wing hate spreaders, Duke also used his Twitter account to bully and harass critics — by being able to direct a nazi troll army of Twitter supporters to target individuals with abuse and try to get their accounts suspended via tricking Twitter’s systems through mass reporting their tweets.

Safe to say, Duke, like all nazis, won’t be missed.

Also doubtless concentrating minds at Twitter on standing up for its own community standards is the #StopHateForProfit ad boycott that’s been taking place this month, with multiple high profile advertisers withdrawing spend across major social media platforms as an objection to their failure to boot out hate speech. 

31 Jul 2020

Twitter says ‘phone spear phishing attack’ used to gain network access in crypto scam breach

Twitter has revealed a little more detail about the security breach it suffered earlier this month when a number of high profile accounts were hacked to spread a cryptocurrency scam — writing in a blog post that a “phone spear phishing attack” was used to target a small number of its employees.

Once the attackers had successfully gained network credentials via this social engineering technique they were in a position to gather enough information about its internal systems and processes to target other employees who had access to account support tools which enabled them to take control of verified accounts, per Twitter’s update on the incident.

“A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all of the employees that were initially targeted had permissions to use account management tools, but the attackers used their credentials to access our internal systems and gain information about our processes. This knowledge then enabled them to target additional employees who did have access to our account support tools,” it writes.

“This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems,” Twitter adds, dubbing the incident “a striking reminder of how important each person on our team is in protecting our service”.

It now says the attackers used the stolen credentials to target 130 Twitter accounts — going on to tweet from 45; access the DM inbox of 36; and download the Twitter data of 7 (previously it reported 8, so perhaps one attempted download did not complete). All affected account holders have been contacted directly by Twitter at this point, per its blog post.

Notably, the company has still not disclosed how many employees or contractors had access to its account support tools. The greater that number, the larger the attack vector which could be targeted by the hackers.

Last week Reuters reported that more than 1,000 people at Twitter had access, including a number of contractors. Two former Twitter employees told the news agency such a broad level of access made it difficult for the company to defend against this type of attack. Twitter declined to comment on the report.

Its update now acknowledges “concern” around levels of employee access to its tools but offers little  additional detail — saying only that it has teams “around the world” helping with account support.

It also claims access to account management tools is “strictly limited”, and “only granted for valid business reasons”. Yet later in the blog post Twitter notes it has “significantly” limited access to the tools since the attack, lending credence to the criticism that far too many people at Twitter were given access prior to the breach.  

Twitter’s post also provides very limited detail about the specific technique the attackers used to successfully social engineer some of its workers and then be in a position to target an unknown number of other staff who had access to the key tools. Although it says the investigation into the attack is ongoing, which may be a factor in how much detail it feels able to share. (The blog notes it will continue to provide “updates” as the process continues.)

On the question of what is phone spear phishing in this specific case it’s not clear what particular technique was successfully able to penetrate Twitter’s defences. Spear phishing generally refers to an individually tailored social engineering attack, with the added component here of phones being involved in the targeting.

One security commentator we contacted suggested a number of possibilities.

“Twitter’s latest update on the incident remains frustratingly opaque on details,” said UK-based Graham Cluley. “‘Phone spear phishing’ could mean a variety of things. One possibility, for instance, is that targeted employees received a message on their phones which appeared to be from Twitter’s support team, and asked them to call a number. Calling the number might have taken them to a convincing (but fake) helpdesk operator who might be able to trick users out of credentials. The employee, thinking they’re speaking to a legitimate support person, might reveal much more on the phone than they would via email or a phishing website.”

“Without more detail from Twitter it’s hard to give definitive advice, but if something like that happened then telling workers the genuine support number to call if they ever need to — rather than relying on a message they receive on the phone — can reduce the likelihood of people being duped,” Cluley added.

“Equally the conversation could be initiated by a scammer calling the employee, perhaps using a VOIP phone service and using caller ID spoofing to pretend to be ringing from a legitimate number. Or maybe they broke into Twitter’s internal phone system and were able to make it look like an internal support call. We need more details!”