400 million Twitter users’ data containing private emails and linked phone numbers have reportedly been up for sale on the black market.
Cybercrime intelligence firm Hudson Rock highlighted a “credible threat” via Twitter on Dec. 24 in which someone is supposedly selling a private database containing contact information of 400 million Twitter user accounts.
“The private database contains devastating amounts of information including emails and phone numbers of high profile users such as AOC, Kevin O’Leary, Vitalik Buterin & more,” Hudson Rock stated, before adding that:
“In the post, the threat actor claims the data was obtained in early 2022 due to a vulnerability in Twitter, as well as attempting to extort Elon Musk to buy the data or face GDPR lawsuits.”
Hudson Rock said that while it has not been able to fully verify the hacker’s claims given the number of accounts, it said that an “independent verification of the data itself appears to be legitimate.”
BREAKING: Hudson Rock discovered a credible threat actor is selling 400,000,000 Twitter users data.
The private database contains devastating amounts of information including emails and phone numbers of high profile users such as AOC, Kevin O’Leary, Vitalik Buterin & more (1/2). pic.twitter.com/wQU5LLQeE1
— Hudson Rock (@RockHudsonRock) December 24, 2022
Web3 security firm DeFiYield also had a look at 1,000 accounts given as a sample by the hacker and verified that the data is “real.” It also reached out to the hacker via Telegram and noted that they are actively waiting for a buyer there.
If found true, the breach could be a significant cause for concern for crypto Twitter users, particularly those who operate under a pseudonym.
However, some users have highlighted that such a large-scale breach is hard to believe, given that the current amount of active monthly users reportedly sits at around 450 million.
At the time of writing, the purported hacker still has a post up on Breached advertising the database to buyers. It also has a specific call to action for Elon Musk to pay $276 million to avoid having the data sold and face a fine from the General Data Protection Regulation agency.
If Musk pays the fee, the hacker says they will delete the data and it will not be sold to anyone else “to prevent a lot of celebrities and politicians from Phishing, Crypto scams, Sim swapping, Doxxing and other things.”
The breached data in question is understood to have come from the “Zero-Day Hack” on Twitter in which an application programming interface vulnerability from Jun. 2021 was exploited before it was patched in January this year. The bug essentially allowed hackers to scrape private info which they then compiled into databases to sell on the dark web.
Related: Crypto Twitter confused by SBF’s $250M bail and a return to luxury
Alongside this supposed database, two others have previously been identified, with one consisting of around 5.5 million users and another thought to contain as much as 17 million users, according to a Nov. 27 report from Bleeping Computer.
The dangers of having such info leaked online include targeted phishing attempts via text and email, sim swap attacks to get ahold of accounts and the doxing of private information.
There are some serious concerns with this.
#1 – Identities of many pseudo accounts will be public, posing risks for them
#2 – With a phone number, it’s super easy to find anyone’s address and banking information.
#3 – Multiple phishing attempts via cellphone, physical, or email— Haseeb Awan – efani.com (@haseeb) December 25, 2022
People are being advised to take precautions such as making sure two-factor authentication settings are turned on for their various accounts, via an app and not their phone number, along with changing their passwords and storing them securely, and also using a private, self-hosted crypto wallet.
