A Twitter security vulnerability discovered in early 2022 has been used to cull the account details of 5.4 million users, and the hacker is offering the set for sale.
A hack of 5.4 million users is small compared to the 478 million T-Mobile customers affected in August 2021. It's even small compared to the 70 million users of AT&T affected later that same month.
Yet according to Restore Privacy, the hacked data now on sale comes from a vulnerability that was reported in January 2022. Twitter acknowledged that this was a valid security issue, and even paid the discoverer, "zhirinovskiy," a $5,040 bounty.
"Exactly as the HackerOne user zhirinovskiy described in the initial report in January, a threat actor is now selling the data allegedly acquired from this vulnerability," says Sven Taylor of Restore Privacy. "The post is still live now with the Twitter database allegedly consisting of 5.4 million users being for sale."
"The seller on the hacking forum goes by the username 'devil,'" continues Taylor, "and claims that the dataset includes 'Celebrities, to Companies, randoms, OGs, etc.'"
"We reached out to the seller of this database to gather additional information," says Taylor. "The seller is asking for at least $30,000 for the database, which is now available due to 'Twitter's incompetence,' according to the seller."
The seller has posted about the data on the site Breach Forums. According to Restore Privacy, the forum's owner has verified the authenticity of the leak.
A sample of the data available is included in the Breach Forums posting. It appears to show publicly-available Twitter profile information alongside phone numbers and/or email addresses used for logging in.
It does not appear to include passwords. While it does contain email addresses that could be used with Twitter's "Forgot Password" feature, a bad actor would have to separately have access to that email account's login password.
Consequently the fear is less that users accounts will be compromised by the bad actors, and more that the data could be sold for advertisers to exploit.
Twitter has not yet commented.
