Introduction
The CEO of Twitter, Elon Musk, has generated a ton of headlines since he took the helm of Twitter. The social media platform enjoys over 450M active users every month. Now Musk is trending again, and not for anything good.
Just as 2022 ended, Twitter experienced a data breach that affected over 400M users!
The Most Recent Hack on Twitter
Some cybersecurity experts warned of this when over half of the staff over at Twitter got laid off in November 2022. The cuts brought Twitter down to just a third of its previous team, which caused speculation about the ongoing security of the platform going forward. Since some of the budget cuts affected security experts and coders, Twitter swiftly experienced issues with important functions that related to user protections, including glitches with the two-factor authentication.
Multi-factor authentication, often shortened to MFA or called two-factor authentication, is one of the most important steps in securing your accounts because it makes you prove your identity in some other way, thereby creating one more roadblock for hackers.
Evidence also suggests that this data leak may date back to a years-old vulnerability that was patched and claimed to be unexploited at the time; however, cybersecurity experts can use Dark Web Monitoring to find your information if it’s up for illegal sale, and Twitter account credentials had already been cropping up on these radars since that previous July.
Whether or not these layoffs contributed to this latest data breach, the fact remains that an as-yet-unidentified hacker made off with private data on nearly 90% of the website’s userbase. After stealing data on over 400M users, the bad actor (going by the screenname Ryushi) then published 235M user records on a popular hacking forum.
Amongst the information stolen are email addresses, full names, and even follower counts! Not only can hackers do a lot of damage to the victim directly, but that information can also be used to crack accounts and spread phishing messages to all their friends. If you use the same log-in credentials everywhere, then all those other accounts could be compromised too.
It gets more audacious: Ryushi then offered Musk a deal to buy back the stolen information.
The Offer Extended
First, some backstory: In 2022, Facebook paid €2.83B (that’s $3.04B) over the course of 1401 violations of data protection laws. Of those fines, €832M (which is $894.35M) were for violating the General Data Protection Regulation law in Europe.
How does this relate to Twitter? The site could face similarly large data protection violation charges because of this massive leak.
The thief declared they would sell the data back to Musk for $200,000. They used the looming threat of these very fines to increase pressure: “Your best option to avoid paying $276 million USD in GDPR breach fines like Facebook did…is to buy this data exclusively.”
The leaked data included information on celebrities like Cara Delevigne and Doja Cat; as well as high-profile figures like Alexandria Ocasio-Cortez (D-NY), Donald Trump Jr. and the World Health Organization.
Conclusion
If your data was involved in this breach, you could be at risk of doxxing, phishing and account compromise. Be on the lookout for suspicious messages or activity in the coming months!
In the meantime, make sure to change your log-in credentials on Twitter as well as any other account that uses the same email and password (which you should never do anyway). Strengthen all of your accounts with multi-factor authentication and consider Dark Web monitoring to check for leaked PII.
Password managers and continuous monitoring services will be your best friends moving forward. Keep an eye out for messages from Twitter about any official direction they recommend for your profile’s ongoing security!
References
- https://www.demandsage.com/twitter-statistics/
- https://www.ign.com/articles/twitters-two-factor-authentication-started-failing-for-certain-users
- https://www.latimes.com/business/story/2023-01-06/twitter-leak-exposes-235-million-email-addresses-from-hack
- https://www.cnet.com/news/social-media/twitter-faces-another-executive-departure-amid-musk-takeover/
- https://www.theverge.com/2023/1/6/23542038/twitter-hack-200-million-email-addresses-usernames-affected
- https://www.strategic-risk-europe.com/home/facebooks-meta-hit-with-hefty-gdpr-fines-in-2022/1443403.article
- https://www.forbes.com/sites/petersuciu/2023/01/04/data-from-200-million-twitter-users-offered-for-free-on-hacker-forum/?sh=2e2c71dd4edf
