Another huge Twitter user database has been leaked online
More than 200 million Twitter data entries are up for sale
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Someone posted a database containing more than 200 million email addresses used for Twitter accounts on the dark web and is selling it for just a handful of dollars - just $2.
According toBleepingComputer, which managed to confirm the authenticity of at least some of theemailaddresses posted in the ad, this is not a new leak, but rather a recycling of the data that was previously leaked via a flawed API call.
Back in 2021, a Twitter API vulnerability was discovered that allowed threat actors to input either email addresses, or phone numbers, into Twitter, to see whether or not they were associated with an active Twitter account. Some might recall, when trying to log into Twitter with a valid email address or phone number, even if thepasswordwas incorrect, the platform would still display the ID and the profile name of the account associated with those credentials.
Cleaning up old leaks
Hackers then used a separate API to scrape the public Twitter data for the IDs and cross-referenced it with email data to generate a list of Twitter accounts.
A year later, in 2022, threat actors started selling databases generated this way. The initial database, containing more than five million entries, went up for sale in mid-2022 for $30,000. The database was subsequently brought down to 400 million entries (probably after eliminating duplicates, fake accounts, etc.), and now, it is down to precisely 221,608,279 lines.
Millions of Twitter users have had their data leaked online>Hacker claims to have private data of 400 million Twitter users for sale>These are the best endpoint protection software right now
Still, the publication found that this database also has duplicates and is not entirely clean.
In total, the threat actor published a set of six text files, combined in a .RAR archive, weighing some 59GB.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Each line in the file carries someidentity-related information: a Twitter user and their email address, name, Twitter handle, number of followers, and creation date. Previous leaks also showed if the account was verified or not, while this database does not.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
