Twitter hacked, over 200 million user email addresses leaked: researchers

Hackers have stolen the email addresses of more than 200 million Twitter users and published them on an online hacking forum, a security researcher said Wednesday.

The breach “unfortunately will lead to a lot of hacking, targeted phishing and doxxing,” Alon Gal, co-founder of Israeli cybersecurity surveillance firm Hudson Rock, continued LinkedIn. He called it “one of the most significant leaks I’ve seen.”

Twitter has not commented on the report, which Gal first posted to social media on December 24, nor has responded to inquiries about the breach since that date. It wasn’t clear what actions Twitter took to investigate or fix the issue.

Reuters could not independently confirm that the data on the forum was authentic and came from Twitter. Screenshots of the hacker forum, where the data appeared on Wednesday, circulated on the Internet.

Troy Hunt, creator of breach notification website Have I Been Pwned, looked at the leaked data and said on Twitter that it “appeared pretty much as it was described”.

There were no clues as to the identity or location of the hacker or the hackers behind the vulnerability. It could have happened as early as 2021, which was before Elon Musk took over the company last year.

Claims about the size and scope of the breach initially varied, with early reports in December saying 400 million email addresses and phone numbers were stolen.

A serious violation at Twitter could interest regulators on both sides of the Atlantic. The Data Protection Commission in Ireland, where Twitter has its European headquarters, and in the US Federal Trade Commission have monitored the Elon Musk-owned company for compliance with European data protection regulations and a US consent order.

Messages left with the two regulators were not immediately returned on Thursday.

© Thomson Reuters 2023