Skip to main content

Oh great, now our Twitter data is for sale on the dark web

In case you haven’t been closely following in-depth hacker news feeds (and we don’t blame you if you haven’t), you may have missed an announcement in January from HackerOne detailing a security vulnerability in the Twitter code. The vulnerability let hackers steal phone numbers and emails of users.

Well, a list of millions of Twitter users just showed up for sale on the dark web.

Restore Privacy, a security and privacy watchdog, reported the list of 5.4 million Twitter user emails and phone numbers for sale on a dark web site called Breached Forums. The hacker selling the list claims it contains the private data of “Celebrities, to Companies, randoms, OGs, etc.”

The vulnerability found in January and the sale of personal datasets from Twitter are too closely linked to be mere coincidence.

In January, HackerOne user zhirinovskiy submitted a bug report he had found while analyzing Twitter’s codebase. It was an exploit that could potentially allow a threat actor to access the emails and phone numbers of Twitter users. Although there was no sign of a data breach at the time, zhirinovskiy was concerned.

“This is a serious threat,” zhirinovskiy said in his bug report. “As people can not only find users who have restricted the ability to be found by email/phone number, but any attacker with a basic knowledge of scripting/coding can enumerate a big chunk of the Twitter user base unavailable to enumeration prior (create a database with phone/email to username connections).”

“Thank you for your report @zhirinovksiy,” a Twitter employee named bugtriage_simon replied to the report. “We’re looking into this and will keep you updated when we have additional information. Thank you for thinking of Twitter security.”

The reply came on January 6, five days after zhirinovskiy posted his report.

On January 13, Twitter closed the report and commented: “We consider this issue to be fixed now. Can you please confirm?”

“I can confirm the issue is fixed,” zhirinovskiy replied the same day. Twitter rewarded him for his efforts.

Judging from the exchange of comments on the initial bug report, it took nearly two weeks for Twitter to fix the vulnerability. At some point, a threat actor snuck in and stole 5.4 million datasets. Whether it was done before zhirinovskiy discovered the exploit or after he had posted it remains unknown. What is known is those emails and phone numbers are now for sale.

If your data was included in the breach, you can expect to receive an uptick in spam emails and scammer calls. We recommend using Apple’s Hide My Email if you have iPhone. Also, check out our tips for increasing your online privacy.

Editors' Recommendations

Nathan Drescher
Nathan Drescher is a freelance journalist and writer from Ottawa, Canada. He's been writing about technology from around the…
The best HP laptops to buy in 2023
HP Spectre x360 13.5 front angled view showing display and keyboard deck.

HP offers several excellent laptop lines that are tailored for professionals, traveling, and student use, and it generally makes great all-purpose laptop models for those who want dependability and performance. HP laptops show up on our best laptops and best 2-in-1s lists, among others. However, picking and customizing an HP laptop can be a confusing process for newcomers, and it's not always immediately clear what differences mark the various HP lines, nor which is the best pick.

Allow us to make the choice easier with our list of the best HP laptops available in 2023, and an explanation of what each model excels at.

Read more
HP Envy x360 2-in-1 laptop just had its price slashed by $300
The Envy x360 13 in tent mode on a table.

Hurry! HP has a fantastic deal on the Envy x360 2-in-1 laptop today. You can grab it for only $600 after a $300 discount. HP is famous for great 2-in-1 laptop deals like this, but they don't stick around long. If you've been waiting for a tablet-laptop-combo and $600 is in your price range, grab this deal before it's gone.

Why you should buy the HP Envy x360 2-in-1 laptop
HP Envy x360 13

Read more
ChatGPT creator seeking to eliminate chatbot ‘hallucinations’
Close up of ChatGPT and OpenAI logo.

Despite all of the excitement around ChatGPT and similar AI-powered chatbots, the text-based tools still have some serious issues that need to be resolved.

Among them is their tendency to make up stuff and present it as fact when it doesn’t know the answer to an inquiry, a phenomenon that’s come to be known as “hallucinating.” As you can imagine, presenting falsehoods as fact to someone using one of the new wave of powerful chatbots could have serious consequences.

Read more