5.3 Million Twitter Accounts from January Breach Leaked as Claims of Larger Breach Surface

Hacker Leaks 5.3M Twitter Accounts as Claims of Larger Breach Surface

A hacker has leaked 5.3 million Twitter account details on a cybercrime forum while another researcher, Chad Loder, claims there is another Twitter breach involving “perhaps over 100 million accounts.”

byHabiba Rashid

November 28, 2022

3 minute read

On August 7th, 2022, Hackread.com reported a story detailing a Twitter data breach involving 5.4 million accounts. Now, the very same data has been leaked on a hacker forum which surfaced as an alternative to popular and now-seized Raidforums.

However, there’s more to it. The end of 2022 does not appear to be on Twitter’s side because it has now become the target of yet another conflict. A Los Angeles-based cyber security researcher revealed on 23rd November that Twitter had experienced a massive breach that allegedly affected millions of users across the US and the EU.

On his now-suspended Twitter account, Chad Loder warned users about the data breach which he stated occurred “no earlier than 2021” and “has not been reported before”. He stated to have seen the stolen data in the alleged breach and had spoken to the potential victims who confirmed that the breach data was “accurate”.

On his Mastodon page, the researcher said that according to his research, it’s probable that there are tens of millions currently affected accounts, possibly hundreds of millions.

However, what is uncertain is whether this breach is the same as the one that previously occurred in July this year which was also confirmed by Twitter, or whether this breach is completely different.

According to Loder, this could not be the same breach until Twitter “lied” about the July breach. He also noted that this data was in a “completely different format” and had “differently affected accounts”.

Within 24 hours of Loder tweeting about this, his Twitter account got suspended due to having “violated the Twitter rules”.

What’s likely is that both breaches exploited the same vulnerability which was first reported by HackerOne in January. It allowed anyone to enter a phone number or email address to find the Twitter handle associated with it. This is a feature used by Twitter as an internal identifier but can be readily converted to a Twitter ID.

At the time, Twitter acknowledged the existence of the vulnerability and stated that it had been patched but did not mention anyone exploiting it. However, it was then reported by Restore Privacy that a hacker had used the vulnerability to put together a dataset consisting of Twitter handles, email addresses, and phone numbers of millions of accounts. The data includes Twitter users in the UK, almost every EU country, and parts of the US.

Any Twitter account with the “let others find you by phone number” setting enabled in its “discoverability” settings is affected. This option is hidden quite deep in Twitter’s settings and is turned on by default.

Keeping in mind the recent news, it becomes apparent that this data was accessed by more than one bad actor. Reports confirm that they were shown a dataset that contained similar information in a different format.

The datasets could be sold to malicious parties who would use the data for advertising purposes or maliciously target certain accounts such as celebrities.