According to a security researcher, hackers obtained the email addresses of more than 200 million Twitter users and posted them on a hacking forum online on Wednesday.
The breach "will unfortunately lead to a lot of hacking, targeted phishing and doxxing," Alon Gal, co-founder of Israeli cybersecurity-monitoring firm Hudson Rock, wrote on LinkedIn. He called it "one of the most significant leaks I've seen."
Twitter hasn't responded
Twitter has not commented on the report, which Gal first posted about on social media on Dec. 24, nor responded to inquiries about the breach since that date. It was not clear what action, if any, Twitter has taken to investigate or remediate the issue.
As per Reuters, it could not be independently verified that the data on the forum was authentic and came from Twitter.
Screenshots of the hacker forum, where the data appeared on Wednesday, have circulated online.
Troy Hunt, creator of breach-notification site Have I Been Pwned, viewed the leaked data and said on Twitter that it seemed "pretty much what it's been described as."
No clues of hacker
There were no clues to the identity or location of the hacker or hackers behind the breach. It may have taken place as early as 2021, which was before Elon Musk took over ownership of the company last year.
At first, there were conflicting reports regarding the magnitude and scope of the breach, with early reports in December claiming that 400 million email addresses and phone numbers were taken.
Regulators on both sides of the Atlantic might be interested in a significant Twitter breach. Twitter is being watched for compliance with European data protection laws and a U.S. consent order by the Data Protection Commission in Ireland, where the company's European headquarters are located, and by the Federal Trade Commission in the United States.
On Thursday, messages left with the two regulators were not promptly responded to.
