Hacker selling Twitter account data of 5.4 million users for $30k

guest · Jul 23, 2022

July 22, 2022

Twitter has suffered a data breach after threat actors used a vulnerability to build a database of phone numbers and email addresses belonging to 5.4 million accounts, with the data now up for sale on a hacker forum for $30,000.

Yesterday, a threat actor known as ‘devil’ said on a stolen data market that the database contains info about various accounts, including celebrities, companies, and random users.

"Hello, today I present you data collected on multiple users who use Twitter via a vulnerability. (5485636 users to be exact)," reads the forums post selling the Twitter data.
Click to expand...

As first reported by Restore Privacy, the vulnerability used to collect the data is the same one disclosed to Twitter through HackerOne on January 1st and fixed on January 13th.

"The vulnerability allows any party without any authentication to obtain a twitter ID (which is almost equal to getting the username of an account) of any user by submitting a phone number/email even though the user has prohibitted this action in the privacy settings," reads the vulnerability disclosure by security researcher 'zhirinovskiy.'
The hacker told us that you could feed email addresses and phone numbers to the vulnerability to determine if it is associated with a Twitter account and retrieve that account's ID.
Click to expand...

Leaked data verified
Twitter has not confirmed the data breach at this time, telling BleepingComputer that they are investigating the authenticity of the claims.

"We received a report of this incident several months ago through our bug bounty program, immediately investigated thoroughly and fixed the vulnerability. As always, we’re committed to protecting the privacy and security of the people who use Twitter. We’re grateful to the security community who engages in our bug bounty program to help us identify potential vulnerabilities such as this.

We are reviewing the latest data to verify the authenticity of the claims and ensure the security of the accounts in question.”
However, BleepingComputer verified with some of the Twitter users listed in a small sample of data shared by the hacker that the private information (email addresses and phone numbers) is accurate.
Click to expand...

RestorePrivacy: Verified Twitter Vulnerability Exposes Data from 5.4 Million Accounts

A verified Twitter vulnerability from January has been exploited by a threat actor to gain account data allegedly from 5.4 million users. While Twitter has since patched the vulnerability, the database allegedly acquired from this exploit is now being sold on a popular hacking forum, posted earlier today.
Click to expand...

EASTER · Jul 23, 2022

Somebody's getting jipped

guest · Jul 25, 2022

Twitter launches probe after miscreants claims to have swiped 5.4m users' details
July 25, 2022

Twitter is investigating claims that a near-seven-month-old vulnerability in its software has been exploited to obtain the phone numbers and email addresses of a reported 5.4 million users.

A miscreant using the handle "devil" claims to have siphoned the details and is selling it all on a cyber-crime forum, according to RestorePrivacy, a digital privacy advocacy group that first reported the security breach. It's said that the info belongs to celebrities, companies, ordinary netizens, and accounts with highly desirable usernames.
Click to expand...

"We are reviewing the latest data to verify the authenticity of the claims and ensure the security of the accounts in question," a Twitter spokesperson wrote in an email to The Register.
The Twitter spokesperson did not respond to The Register's questions about whether the owners of the accounts in question have been notified, and what the company is doing to mitigate the issue.
Click to expand...

mood said: ↑

July 22, 2022

RestorePrivacy: Verified Twitter Vulnerability Exposes Data from 5.4 Million Accounts
Click to expand...

Update:

Update July 24, 2022: Twitter has confirmed they are investigating the situation, but has not provided any more information at this time.
Click to expand...

guest · Aug 5, 2022

Twitter confirms zero-day used to expose data of 5.4 million accounts
August 5, 2022

Twitter has confirmed a recent data breach was caused by a now-patched zero-day vulnerability used to link email addresses and phone numbers to users' accounts, allowing a threat actor to compile a list of 5.4 million user account profiles.

Last month, BleepingComputer spoke to a threat actor who said that they were able to create a list of 5.4 million Twitter account profiles using a vulnerability on the social media site.
This vulnerability allowed anyone to submit an email address or phone number, verify if it was associated with a Twitter account, and retrieve the associated account ID. The threat actor then used this ID to scrape the public information for the account.
Click to expand...

Twitter confirms zero-day used to collect data
Today, Twitter has confirmed that the vulnerability used by the threat actor in December is the same one reported to and fixed by them in January 2022 as part of their HackerOne bug bounty program.,

"In January 2022, we received a report through our bug bounty program of a vulnerability that allowed someone to identify the email or phone number associated with an account or, if they knew a person's email or phone number, they could identify their Twitter account, if one existed," Twitter disclosed in a security advisory today.
While no passwords were exposed in this breach, Twitter is encouraging users to enable 2-factor authentication on their accounts to prevent unauthorized logins as a security measure.
Click to expand...

Twitter: An incident impacting some accounts and private information on Twitter

In July 2022, we learned through a press report that someone had potentially leveraged this and was offering to sell the information they had compiled. After reviewing a sample of the available data for sale, we confirmed that a bad actor had taken advantage of the issue before it was addressed.

We will be directly notifying the account owners we can confirm were affected by this issue. We are publishing this update because we aren’t able to confirm every account that was potentially impacted, and are particularly mindful of people with pseudonymous accounts who can be targeted by state or other actors.
Click to expand...

guest · Aug 6, 2022

Twitter breach exposes anonymous accounts to nation state hackers
August 5, 2022

Twitter confirmed Friday that a bad actor used a vulnerability to match private information with potentially anonymous Twitter accounts, posing risks to users privacy.

“We can confirm the impact was global,” a Twitter spokesperson said in an email. “We cannot determine exactly how many accounts were impacted or the location of the account holders.”
“We are publishing this update because we aren’t able to confirm every account that was potentially impacted, and are particularly mindful of people with pseudonymous accounts who can be targeted by state or other actors,” Twitter said in a blog.
Click to expand...

In Iran, Twitter has also become a popular platform for political dissidents.
Data exposed in the Twitter breach would be a gold mine for authorities in countries such as Iran or Saudi Arabia, says Cerfta Lab founder Amin Sabeti, who specializes in Iran-related security research.

“If the Iranian regime can get a copy of this data and then find their target, it doesn’t matter if the user deletes the account right now because the user will be identified via mobile number or email,” Sabeti wrote in a message to CyberScoop.
Click to expand...

The company is warning users to not tie sensitive data to anonymous accounts.

“To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account.”
Click to expand...

guest · Nov 26, 2022

Massive Twitter data breach was far worse than reported, reveal security researchers
By Ben Lovejoy @benlovejoy - November 25, 2022

A massive Twitter data breach last year, exposing more than five million phone numbers and email addresses, was worse than initially reported. We’ve been shown evidence that the same security vulnerability was exploited by multiple bad actors, and the hacked data has been offered for sale on the dark web by several sources.

It had previously been thought that only one hacker gained access to the data, and Twitter’s belated admission reinforced this impression …
Click to expand...

Background
HackerOne first reported the vulnerability back in January, which allowed anyone to enter a phone number or email address, and then find the associated twitterID. This is an internal identifier used by Twitter, but can be readily converted to a Twitter handle.
Massive Twitter data breach plural, not singular
There were suggestions on Twitter yesterday that the same personal data had been accessed by multiple bad actors, not just one. 9to5Mac has now seen evidence that this is indeed the case. We were shown a dataset which contained the same information in a different format, with a security researcher stating that it was “definitely a different threat actor.” The source told us that this was just one of a number of files they have seen.

Bad actors are believed to have been able to download around 500k records per hour, and the data has been offered for sale by multiple sources on the dark web for around $5k.
Click to expand...

guest · Dec 29, 2022

Hacker claims to have private data of 400 million Twitter users for sale
By Craig Hale - December 27, 2022

The data is said to have been captured in 2021, and was obtained using an API vulnerability that has since been fixed.

The threat actor, who calls themself ‘Ryushi’, has advised Elon Musk and Twitter to buy the data for the asking price of $200,000, or face an even larger GDPR fine.
Click to expand...

Twitter data leak 2022
The threat actor, who appears to have joined the Breached hacking forum in December 2022, wrote:

“Your best option to avoid paying $276 million USD in GDPR breach fines like facebook did (due to 533m users being scraped) is to buy this data exclusively… after that I will delete this thread and will not sell this data again.”
If an exclusive sale to Twitter (or any other party who wants the information) is not made for $200,000, the hacker claims that they will sell the data to multiple buyers for $60,000 each.
Click to expand...

Bleeping Computer reports that the API that caused the vulnerability was fixed in January 2022, however multiple threat actors have been confirmed to have used it, putting more than 400 million users are risk of scams and phishing attacks.
Click to expand...

guest · Jan 1, 2023

mood said: ↑

Hacker claims to have private data of 400 million Twitter users for sale
By Craig Hale - December 27, 2022
Click to expand...

Twitter in data-protection probe after '400 million' user details up for sale
By Chris Vallance - December 30, 2022

A watchdog is to investigate Twitter after a hacker claimed to have private details linked to more than 400 million accounts.
Click to expand...

The hacker, "Ryushi", is demanding $200,000 (£166,000) to hand over the data - reported to include that of some celebrities - and delete it.

Ireland's Data Protection Commission (DPC) says it "will examine Twitter's compliance with data-protection law in relation to that security issue".
Twitter has not commented on the claim.
Click to expand...

The Guardian reported that data of US Congresswoman Alexandria Ocasio-Cortez was included in the sample of data published by the hacker. The data of broadcaster Piers Morgan, who recently had his Twitter account hacked, is also reported to be included.

Cyber-crime intelligence company Hudson Rock says it was the first to raise the alarm about the data sale.
The data did not appear to have been copied from an earlier breach in which details were published from 5.4 million Twitter accounts, Mr Gal said.
Click to expand...

guest · Jan 4, 2023

Account Details of Over 200 Million Twitter Users Leaked on Hacker Forum
By Miklos Zoltan @mzb4455 - January 4, 2023

Today, on a popular hacker forum, data of over 200 million Twitter users was leaked for anyone to download. The hackers claim to have obtained this data through scraping.
Highlights

Personal details of over 200 million Twitter accounts were leaked on a hacker forum

Leaked data includes account name, handle, creation date, follower count, and email address

Leaked data could be used for social engineering or doxxing campaigns

Leaked data could be used to hack Twitter users’ accounts

Click to expand...

Twitter seems to have experienced another data leak on January 4, when a user on a known hacker forum released a database containing scraped information on over 200 million Twitter users.

The database uploaded to the forum is of 63 GB. It contains information on over 200 million accounts, such as screen name, full name, follower number, date of creation, and most importantly, the registered email address.
The full dataset is freely available for anyone to download.
Click to expand...

Update: This new leak appears to be the same as the one reported in December 2022 that affected over 400 million accounts.

The 200 million number in this case resulted from the removal of duplicates.
However, this time, the data is available for anyone to download for free, instead of being listed for sale at $200,000, as it was in December.
Click to expand...

Privacy Affairs cybersecurity experts reviewed the published data and believe this latest leak could lead to social engineering attacks and doxxing.

This newest leak follows another leak in December 2022 when cybercriminals released data from over 400 million Twitter accounts.
As such, even if that leak was bigger in scale, this new one could be considered more severe, as now many more bad actors can obtain this data.
Click to expand...

guest · Jan 6, 2023

Twitter: check if your email address is among the 200 million leaked
By Martin Brinkmann - January 6, 2023

Over 200 million email addresses were copied from Twitter in early 2023. News of the leak broke when the email addressed turned up in a hacking forum.
Click to expand...

Active Twitter users and those who signed up for the messaging service in the past, but have not used the service actively for some time, may want to know whether their email address was included in the leak.

The popular Have I Been Pwned website added the over 200 million email addresses to its database. Any user may check if a particular email address was included in the leak.
To check, simply visit the website linked above and enter the email address that you want to check. The site reveals if the email address was leaked in the Twitter hack or in any of the other password databases that it is aware of.

Note that the Twitter password was not included in the leak.
Click to expand...

Data has been added to Have I Been Pwned:

Twitter – 211,524,284 breached accounts

Twitter (200M)
In early 2023, over 200M records scraped from Twitter appeared on a popular hacking forum. The data was obtained sometime in 2021 by abusing an API that enabled email addresses to be resolved to Twitter profiles. The subsequent results were then composed into a corpus of data containing email addresses alongside public Twitter profile information including names, usernames and follower counts.

Breach date: 1 January 2021
Date added to HIBP: 5 January 2023
Compromised accounts: 211,524,284
Compromised data: Email addresses, Names, Social media profiles, Usernames
Permalink
Click to expand...

guest · Jan 8, 2023

What Twitter’s 200 million email leak really means
Lily Hay Newman, wired.com @WIRED - January 7, 2023

After reports at the end of 2022 that hackers were selling data stolen from 400 million Twitter users, researchers now say that a widely circulated trove of email addresses linked to about 200 million users is likely a refined version of the larger trove with duplicate entries removed. The social network has not yet commented on the massive exposure, but the cache of data clarifies the severity of the leak and who may be most at risk as a result of it.
Click to expand...

While it was live, the vulnerability was seemingly exploited by multiple actors to build different collections of data.

Twitter did not reply to WIRED's requests for comment. The company wrote about the API vulnerability in an August disclosure: “When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability.” Seemingly, Twitter's telemetry was insufficient to detect the malicious scraping.

“Obviously, there are multiple people who were aware of this API vulnerability and multiple people who scraped it. Did different people scrape different things? How many troves are there? It kind of doesn't matter,” says Troy Hunt, founder of the breach-tracking site HaveIBeenPwned.
Click to expand...

For users who hadn't already linked their Twitter handles to burner email accounts at the time of the scraping, though, the advice comes too late. In August, the social network said it was notifying potentially impacted individuals about the situation. The company has not said whether it will do further notification in light of the hundreds of millions of exposed records.

Ireland’s Data Protection Commission said last month that it is investigating the incident that produced the trove of 5.4 million users' email addresses and phone numbers.
Click to expand...

This story originally appeared on wired.com.
Click to expand...

guest · Jan 11, 2023

Twitter claims leaked data of 200M users not stolen from its systems
By Sergiu Gatlan @serghei - January 11, 2023

Twitter finally addressed reports that a dataset of email addresses linked to hundreds of millions of Twitter users was leaked and put up for sale online, saying that it found no evidence the data was obtained by exploiting a vulnerability in its systems.

"In response to recent media reports of Twitter users' data being sold online, we conducted a thorough investigation and there is no evidence that data recently being sold was obtained by exploiting a vulnerability of Twitter systems," the company said.
Click to expand...

Today, Twitter said that another dataset containing email addresses linked to 200 million Twitter users that reportedly got leaked online earlier this month was not obtained by exploiting the vulnerability patched in January 2022.

"[The] 200 million dataset could not be correlated with the previously reported incident or any data originating from an exploitation of Twitter systems," Twitter said.
"None of the datasets analyzed contained passwords or information that could lead to passwords being compromised."
However, Twitter failed to explain in today's statement how the Twitter users' leaked data was accurately linked to email addresses associated with their accounts.
Click to expand...

Twitter added that it's currently in contact with Data Protection Authorities and other relevant data regulator bodies in multiple countries to provide additional details regarding the "alleged incidents."
Click to expand...

Log in or Sign up

Hacker selling Twitter account data of 5.4 million users for $30k

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hacker selling Twitter account data of 5.4 million users for $30k

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches