In a statement, Twitter confirmed that the recent data leak of millions of user profiles – which included private phone numbers and email addresses – was due to a data breach that the company in August 2022 (the breach took place in 2021).
Twitter's security incident response team conducted an analysis of the recently leaked user data and found that it was collected through a security vulnerability, which had been patched in January 2022.
See also: Serious flaw found in Amazon ECR public gallery
According to Twitter's statement, in July 2022, it became known through publications that someone had exploited the vulnerability and had collected user information, which they wanted to sell. The company says that it reviewed a sample of the data available for sale and confirmed that a malicious user had exploited the security flaw before it was addressed. At that time, the social networking company notified users who had been affected by the data.
“In November 2022, some publications reported that Twitter user data had been leaked online,” the update states.
“Upon learning of the news, Twitter’s Incident Response Team compared the data in the new report with the data reported by the media on July 21, 2022. The comparison showed that the exposed data was the same in both cases,” Twitter says.
dataleaked on hacking forum
In January 2022, Twitter was notified of a bug that allowed someone to enter an email address or phone number and obtain the Twitter ID of any registered account associated with it.
See also: ChatGPT: AI bot could help cybercriminals
This could pose a significant privacy risk for Twitter users who don't want to make their phone numbers and email addresses public.
By the time Twitter fixed the problem, a malicious actor had already exploited the vulnerability to import millions of email addresses and phone numbers and create profiles for 5.4 million users that contained both public and private data.
The collected data was put up for sale on a hacking forum in July 2022. The asking price was $30,000.
In September 2022 and November 2022, a hacker released a JSON file containing the full set of 5.4 million files collected in 2021.
Around the same time, a researcher also shared samples of an additional set of Twitter profiles that had been harvested using the same vulnerability. These profiles were not included in the original data leak of 5.4 million Twitter users.
This dataset is said to be much more extensive, as it reportedly contains 17 million records collected using the same API flaw.
BleepingComputer used a sample of this new data to contact Twitter users and confirmed that the leaked phone number belonged to them.
While Twitter's latest update confirms that the data leaked last month is related to the previously disclosed vulnerability, the company has yet to announce how many users were affected.
Twitter recommends that users take additional security measures, such as two-factor authentication, using authentication apps or hardware keys. It also asks users to be extremely careful with messages or emails that refer to their Twitter account.
See also: Stalkerware apps flood iPhone and Android devices
“We encourage Twitter users to remain extremely cautious when receiving any type of email, as threat actors may leverage the leaked information to create very effective phishing campaigns,” Twitter warns.
In a world where technology is increasingly integrated into our lives, data breaches are becoming a growing concern. A data breach/leak is an incident that involves the unauthorized access to sensitive information by a malicious third party. These incidents can have significant consequences for business owners, customers, and employees.
Source: www.bleepingcomputer.com
