Twitter finally broke its silence over the first security incident of the Musk era: an alleged data breach that exposed the contact information of millions of users
In late December, a poster on a popular cybercrime forum claimed to have scraped the email addresses and phone numbers of 400 million Twitter users by way of a zero-day security flaw in Twitter’s systems, previously blamed for exposing at least 5 million Twitter accounts before it was fixed in January 2022. The subsequent sale of another, smaller dataset containing the email addresses associated with more than 235 million Twitter accounts is said to be a cleaned-up version of the alleged dataset of 400 million Twitter users. Researchers warned that the email addresses, which included the details of politicians, journalists and public figures, could be used to dox pseudonymous accounts.
Twitter, or what’s left of the company, addressed the situation last week.
In an unattributed blog post, Twitter said it had conducted a “thorough investigation” and found “no evidence” that the data sold online was obtained by exploiting a vulnerability of Twitter’s systems. An absence of evidence, however, is not vindication, as it’s unclear if Twitter has the technical means, such as logs, to determine if any user data was exfiltrated. Rather, the company said that hackers had likely been circulating a collection of data pulled from past breaches and said the data did not correlate to any of the data obtained by way of exploiting the bug that was fixed in January 2022.
What Twitter is saying may very well be true, but it’s difficult to have confidence in the company’s statement. Twitter’s erratic response raises many of the same questions that regulators will want to know: Who was tasked with investigating this breach, and does Twitter have the resources to do a thorough job?
Reddit has confirmed hackers accessed internal documents and source code following a “highly-targeted” phishing attack. A post by Reddit CTO Christopher Slowe, or KeyserSosa, explained that on February 5 the company became aware of the “sophisticated” attack targeting Reddit employees. He says that an as-yet-unidentified attacker sent “plausible-sounding prompts,” which redirected employees to a website masquerading as Reddit’s […]
e new year has kicked off with some hefty security updates released by the likes of Apple, Google, and Microsoft. January has been a busy time for enterprise patches too, with SAP, VMWare, and Oracle among those issuing security fixes during the month. Here’s everything you need to know about the security fixes released in […]
ate on Friday, Twitter announced a new policy that will remove text message two-factor authentication (2FA) from any account that won’t pay for it. In a blog post, Twitter said that it will only allow accounts that subscribe to its premium Twitter Blue feature to use text message-based 2FA. Twitter users that don’t switch to a different […]
Leave a Reply