Skip to main content

Twitter says state-backed attackers may have nabbed phone numbers

Twitter has revealed more details about a security incident that allowed attackers to discover phone numbers attached to numerous accounts on its platform.

The process involved exploiting a feature, which, when used in the intended way, lets new sign-ups find friends who are already on Twitter by inputting their phone number. The feature works for those who have enabled the “Let people who have your phone number find you on Twitter” option and who have a phone number associated with their Twitter account.

The company said that during a recent investigation, it discovered and subsequently shut down a large network of fake accounts that may have been attempting to match a huge number of generated phone numbers to Twitter accounts.

It said it realized something was wrong when it observed “a particularly high volume” of attempts coming from individual IP addresses located within Iran, Israel, and Malaysia, adding, “It is possible that some of these IP addresses may have ties to state-sponsored actors.” Speaking to Reuters, a Twitter spokesperson said its team had particular concerns about Iran as the attackers seemed to have had unrestricted access to the social media platform despite it being banned in the country.

Twitter said it has now made changes to its system to prevent similar attacks in the future, and also shut down the accounts that it believed were attempting to exploit the flaw.


The issue was first exposed in December 2019 by London-based security researcher Ibrahim Balic. It seems that it was Balic’s discovery that prompted Twitter’s investigation, which led to the suspected state-backed attackers. Balic showed that he was able to match 17 million phone numbers to Twitter accounts by uploading more than 2 billion random numbers to the service. The exercise enabled him to discover the phone numbers of various high-profile Twitter users, among them politicians and officials.

The incident is the latest in a series of security mishaps to hit Twitter. Late last year, for example, the company revealed it had patched a vulnerability in its Android app that could have let malicious actors view information of private accounts and take over profiles, and even send direct messages and tweets on the target account’s behalf. Another error saw the platform reveal the tweets of protected accounts.

Announcing details of security incidents is part of Twitter’s recently launched effort to be more transparent with its community of around 330 million people globally.

Editors' Recommendations

Trevor Mogg
Contributing Editor
Not so many moons ago, Trevor moved from one tea-loving island nation that drives on the left (Britain) to another (Japan)…
Elon Musk says he’s appointed a new Twitter CEO
A digital image of Elon Musk in front of a stylized background with the Twitter logo repeating.

Twitter owner Elon Musk has found someone to replace him as the company’s CEO, but he hasn't revealed who it is.

Musk tweeted on Thursday that the new CEO will step into the role at some point over the next six weeks.

Read more
Check your Apple Card right now — you may have a crazy 10% cash-back promo
Daily Cash page for the Apple Card, showing a 10% back promo for grocery store purchases.

If you’re an Apple Card user, you may want to check if you have a new offer waiting for you that will net you up to 10% cash back on grocery store purchases. Yes, you read that correctly — 10% cash back.

Apple is quietly boosting Apple Card rewards with this new promotion that seems to only be available to select users through May 31. The timing of this offer follows the launch of the Apple Card Savings account earlier in the month.

Read more
Twitter is down and not letting us tweet — it says users are over a daily limit [Update]
Error message on Twitter saying you are "over the daily limit for sending Tweets."

As of 6:10 p.m. ET, Twitter users appear to be able to tweet like normal once again. The original story is as follows:

It's nearly impossible to keep up with every new bug/feature/mishap at Twitter these days, but some are more noteworthy than others. Such is the case with today's bug (?), in which Twitter tells users that they are "over the daily limit for sending tweets."

Read more