Twitter data breach: 6.7M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2022-08-13
In January 2022, a vulnerability in Twitter's platform allowed an attacker to build a database of the email addresses and phone numbers of millions of users of the social platform. In a disclosure notice later shared in August 2022, Twitter advised that the vulnerability was related to a bug introduced in June 2021 and that they are directly notifying impacted customers. The impacted data included either email address or phone number alongside other public information including the username, display name, bio, location and profile photo. The data included 6.7M unique email addresses across both active and suspended accounts, the latter appearing in a separate list of 1.4M addresses. Exposed data: bios, email addresses, geographic locations, names, phone numbers, profile photos, usernames. The breach dates from Jan 1, 2022; Have I Been Pwned loaded it on Aug 13, 2022.
What to do
- If you had a Twitter account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
