A vulnerability in Twitter’s security allowed an attacker to learn account names associated with certain email addresses and phone numbers, according to the report. This can include anonymous celebrity accounts.

what is known

The vulnerability was discovered in late 2021. It was announced on January 1, 2022. But according to a report by Bleeping Computer, it was used to collect data from 5.4 million users a month ago in December. They are now selling for $30,000 on a hacker forum and the first leads are already there.

Hello, today I present to you the data collected about many users who use Twitter, [зібрані] through the vulnerability. (5,485,636 users to be exact). These users range from celebrities to companies, casual users, OGs, etc.
– said in the announcement of the hackers, about which the journalists of the publication spoke.

Security researchers said the vulnerability allows third parties to retrieve any user’s unique Twitter ID without any authentication by sending a phone number/email address, even if the user has disabled this activity in their privacy settings. With this identity, the rest of the publicly available data is likely to have been collected. The error was in the authorization process used in Twitter’s Android client, specifically the verification process.

The company, which closed the vulnerability 12 days after it was announced and said that no one exploited the vulnerability, has now analyzed the claims of the hackers and confirmed that they are true. Twitter said it plans to notify affected users, but cannot confirm every potentially affected account. The social network is for anyone who is concerned about their private accounts. Enable two-factor authentication and add an email address or phone number that is not publicly known.