January 06, 2023, 01:48 PM
Follow us on Telegram for the latest updates: https://t.me/mothershipsg
The email addresses of over 200 million Twitter users are believed to have been leaked.
According to a tweet on Jan. 4 by Cyber-crime information firm Hudson Rock, the breach is "one of the most significant leaks ever."
Twitter database leaks for free with 235,000,000 records.
The database contains 235,000,000 unique records of Twitter users and their email addresses and will unfortunately lead to a lot of hacking, targeted phishing, and doxxing.
This is one of the most significant leaks ever. pic.twitter.com/kxRY605qMZ
— Hudson Rock (@RockHudsonRock) January 4, 2023
The data is allegedly being made available on the hacking forum Breached for about S$2.60 according to tech news website Bleeping Computer.
Over a combined 59 GB worth of data — supposed to contain 235,000,000 email addresses — was leaked in the form of six text files.
Bleeping Computer reported that many of the email addresses listed in the files were legitimately linked to the corresponding Twitter profiles.
However, they have not been able to confirm the entire set's veracity.
Ongoing problem
According to BBC, news of this breach followed a warning from Hudson Rock on Dec. 25 that the data of 400 million Twitter users had been breached.
This breach included emails and phone numbers.
BREAKING: Hudson Rock discovered a credible threat actor is selling 400,000,000 Twitter users data.
— Hudson Rock (@RockHudsonRock) December 24, 2022
The private database contains devastating amounts of information including emails and phone numbers of high profile users such as AOC, Kevin O'Leary, Vitalik Buterin & more (1/2). pic.twitter.com/wQU5LLQeE1
The hacker, "Ryushi", had demanded US$200,000 (S$269,000) from Twitter to in exchange for the data.
They are believed to have exploited an API vulnerability, which allowed them to input email addresses and phone numbers to confirm if they were associated with a Twitter ID.
Potential consequences
Though the latest data leak only contains email addresses, Bleeping Computer reported that threat actors could use them to start phishing attacks.
The leak could also be used to identify Twitter users who tweet anonymously.
Data breach notification service Have I Been Pwned has added the data leak to its system and begun notifying subscribers if their email was found in the data set.
Top photo via Flickr/Wikimedia Commons
If you like what you read, follow us on Facebook, Instagram, Twitter and Telegram to get the latest updates.