WASHINGTON ― Twitter says a list of usernames and passwords posted online by hackers was not obtained by exploiting vulnerabilities in the social media site’s security systems.
The company said it has carried out an investigation following reports earlier this month that a database had been posted online showing account details for more than 200 million Twitter users.
According to reports from security researchers and others, the usernames and email addresses in the leak were compiled from several other, earlier Twitter breaches dating back to a bug in Twitter’s systems created in 2021 and fixed in early 2022.
The bug meant that anyone who submitted an email address or phone number to Twitter’s systems would be told what account those details were linked to if any – a flaw that Twitter confirmed last summer had been exploited by hackers.
However, Twitter says its investigation into this latest dataset found that the information in the database “could not be correlated with the previously reported incident or any data originating from an exploitation of Twitter systems”.
“Therefore, based on information and intel analysed to investigate the issue, there is no evidence that the data being sold online was obtained by exploiting a vulnerability of Twitter systems,” the company said.
“The data is likely a collection of data already publicly available online through different sources.”
Twitter joined cybersecurity experts in urging users to protect their accounts by ensuring they use a strong password and two-factor authentication to prevent unauthorised log-ins.
“We also encourage Twitter users to remain extra vigilant when receiving any kind of communications over email, as threat actors may leverage the leaked information to create very effective phishing campaigns.
“Be wary of emails conveying a sense of urgency and emails requesting your private information, always double check that emails are coming from a legitimate Twitter source.”
In recent weeks, two Cabinet ministers have had their Twitter accounts hacked.
Discussion about this post