An API flaw that was patched in January allowed for the theft of over 5.4 million Twitter user records that contained private information. These records were made available for free sharing on a hacker forum.
A security researcher has also revealed another enormous, possibly more significant, data dump of millions of Twitter records, illustrating how widely this flaw was utilised by threat actors.
The material is made up of public data that has been scraped as well as secretive email addresses and phone numbers.
The data breach on Twitter
In July of last year, a threat actor started charging $30,000 for the personal data of more than 5.4 million Twitter users.
The majority of the material was made up of publicly available details such Twitter IDs, names, login names, localities, and verified statuses; however, there was also private information like phone numbers and email addresses.
This information was gathered in December 2021 by utilising a Twitter API flaw that was made public through the HackerOne bug bounty programme. This flaw allowed users to submit their phone numbers and email addresses to the API in order to obtain the corresponding Twitter ID.
It is unclear if the HackerOne disclosure was leaked, but BleepingComputer was told that multiple threat actors were utilizing the bug to steal private information from Twitter.
Twitter confirmed it had experienced a data breach due to an API issue resolved in January 2022 after BleepingComputer sent them a sample of the user details.
This past weekend, Pompompurin, the proprietor of the Breached hacking forum, revealed to BleepingComputer that they were in charge of exploiting the flaw and producing the enormous dump of Twitter user data after another threat actor going by the name of “Devil” disclosed the vulnerability to them.
Nearly 7 million Twitter profiles with private information were found overall, including the 5.4 million records for sale and an additional 1.4 million suspended user profiles that were gathered using a different API.
Sharing of Twitter data on a hacking forum
The Whopping 5.4 million Twitter records have now been freely shared on a hacking forum twice—once in September and most recently on November 24.
This data, which includes 5,485,635 records of Twitter users, was for sale in August, and Pompompurin has confirmed this to BleepingComputer.
These records include the account’s Twitter ID, name, screen name, verified status, location, URL, description, follower count, account creation date, friends count, favourites count, statuses count, and profile image URLs, along with either a private email address or phone number.
An even larger data dump was privately created
While it is concerning that threat actors released the 5.4 million records for free, an even larger data dump was allegedly created using the same vulnerability.
This data dump potentially contains tens of millions of Twitter records consisting of personal phone numbers collected using the same API bug, and public information, including verified status, account names, Twitter ID, bio, and screen name.
The news of this more significant data breach comes from security expert Chad Loder, who first broke the news on Twitter and was suspended soon after posting. Loder subsequently posted a redacted sample of this larger data breach on Mastodon.
“I have just received evidence of a massive Twitter data breach affecting millions of Twitter accounts in EU and US. I have contacted a sample of the affected accounts and they confirmed that the breached data is accurate. This breach occurred no earlier than 2021,” Loder shared on Twitter.
BleepingComputer has obtained a sample file of this previously unknown Twitter data dump, which contains 1,377,132 phone numbers for users in France.
We have since confirmed with numerous users in this leak that the phone numbers are valid, verifying this additional data breach is real.
Furthermore, none of these phone numbers are present in the original data sold in August, illustrating how much larger Twitter’s data breach was than previously disclosed and the large amount of user data circulating among threat actors.
Pompompurin also confirmed with BleepingComputer that they were not responsible and did not know who created this newly discovered data dump, indicating that other people were using this API vulnerability.
BleepingComputer has learned that this newly discovered data dump consists of numerous files broken up by country and area codes, including Europe, Israel, and the USA.
We were told that it consists of over 17 million records but could not independently confirm this.
As this data can be potentially used for targeted phishing attacks to gain access to login credentials, it is essential to scrutinize any email that claims to come from Twitter.
If you receive an email claiming your account was suspended, there are log in issues, or you are about to lose your verified status, and it prompts you to login on to a non-Twitter domain, ignore the emails and delete them as they are likely phishing attempts.
Discussion about this post