Reports last month that over 5.4 million Twitter user records had been leaked to a hackingprompted the Irish Data Protection Commission (DPC) to launch an investigation into the massive data breach.
See also: Gemini: Breach exposed data of 5.7 million customers
By exploiting an API vulnerability that Twitter had patched in January, a criminal managed to steal this data which included public information as well as private phone numbers and email addresses.
The European Union's top supervisory body for Twitter wants to confirm whether the platform has fulfilled its duties as a controller of user data and whether or not it violated the laws of the EU's General Data Protection Regulation (GDPR) or the provisions outlined in the 2018 Data Protection Act.
The privacy authority imposed a €450,000 (~$550,000) fine on Twitter two years ago for violating the GDPR for reporting and recording data breaches.
See also: Uber once again fell victim to a data breach
Last November, the DPC severely reprimanded Meta with a fine of 265 million euros ($275.5 million) due to a massive data breach that exposed personal information of hundreds of millions of Facebook users worldwide, in 2021.
Then, Facebook user data was leaked to a well-known hacking forum, which gave malicious actors an advantageous opportunity to use it for targeted attacks.
In July 2022, the personal data of more than 5.4 million Twitter users was offered for sale on a hacker forum for the price of $30,000!
See also: CommonSpirit Health: Ransomware attack led to data breach
Much of the information contained in this database was public, including Twitter usernames, locations, and verified statuses. However, what made it such a major security breach is that it also contained non-public information, such as email addresses and phone numbers.
Chad Loder recently alerted the public via Twitter and Mastodon about a massive data dump, potentially including millions of records with personal phone numbers collected through a now-fixed API bug combined with some publicly available information, such as verified status, account names, Twitter ID, profile description, and username.
