The leaked Twitter data is now circulating on several hacking forums, including prominent Russian-language ones.
Personal data, including email addresses, of nearly 209 million Twitter users were scraped, stolen, and posted on an online hacking forum. As seen by Hackread.com, the database posted online contains 209,000,000 records, all belonging to Twitter users.
The database comprises usernames, follower counts, creation dates, and email addresses of Twitter users. The good news is that no passwords, phone numbers, IP addresses, or physical addresses were leaked.
Although some reports claim that the total number of leaked accounts is 235 million, Hackread.com’s analysis suggests that the exact number, after deleting duplicate accounts, is 209 million.
This should not come as a surprise, as just a couple of months ago, a hacker leaked 5.4 million account details of Twitter users. This was followed by another incident in which a threat actor was selling scraped data of 400 million Twitter users.
The data leak is currently being regarded as one of the most impactful and significant leaks he has seen so far because leaking such a vast amount of email IDs can expose the victims to a range of attacks, including doxing, hacking, and targeted phishing.
The information can expose the users’ real identities since people use their real names to create email addresses.
It is worth noting that the threat actor leaked the data on a hacker forum that surfaced as an alternative to the popular and now-seized Raidforums. In their post, they stated that the leaked data was collected through web scraping techniques however some sites are reporting it as a “Twitter data breach,” or ” Twitter being hacked.”
However, some are of the opinion that the leaked data is at least two years old. Ron Scott-Adams, VMware’s product line marketing manager, examined the data and claimed that it is at least two years old, and except for email addresses, it mainly consists of publicly available data.
Conversely, Synopsys’ associate principal consultant, Jamie Boote, stated that the data was collected through web scraping via a now-fixed Twitter bug.
“In 2021, people discovered that the Twitter API could be used to disclose email addresses that were provided from other sources and also leak some other semi-public info like tying a Twitter handle with that email address,” the email dumps were then used by different groups as seed material to look for handles they could exploit, added Boote.
This issue was fixed one year back so it seems that someone collected the data, combined it with new accounts, and leaked it online. HaveIBeenPwned’s Troy Hunt also assessed the data and stated that it is pretty much what it has been described as.
It is still unclear who hacked and leaked the data online. But security experts are sure that the breach occurred in 2021. Nevertheless, the incident reveals the dangers of unsecured API. Users must change their Twitter password and ensure the same password isn’t used for other sites.
Twitter is yet to comment.
Related News
- APT Groups Trapping Targets with Clever Twitter Scheme
- Researcher logs into Trump’s Twitter with password MAGA2020
- Twitter hacker charged in sim swapping, cryptocurrency scheme
- Twitter Goes on Tor with New Dark Web Domain to Evade Censorship
- Mastermind of 2020’s top celebrity Twitter hack sentenced to 3 years