Twitter has confirmed a flaw in its code led to a data leak late last year. In a blog post The company says a malicious actor took advantage of the zero-day vulnerability before it realized and patched the issue in January 2022. The vulnerability was discovered by a security researcher who contacted Twitter via Twitter. company. .
When Twitter first learned about the vulnerability, Twitter said it had “no evidence” to suggest it was exploited. However, an individual last month that they took advantage of the vulnerability to get the data of more than 5.4 million accounts. Twitter said it could not confirm how many users were affected by the exposure. The vulnerability allows bad actors to determine if an email address or phone number is associated with an existing Twitter account. In turn, they can use that information to identify the account owner.
“We are publishing this update because we cannot confirm every potentially affected account, and are particularly mindful of those with fake accounts that could be targeted by the state or other actors. ,” said Twitter. “If you run a Twitter account under a pseudonym, we understand the risks an incident like this can pose and deeply regret that this happened.”
Twitter said it will notify any account owners directly that they can confirm have been affected by the disclosure. For users trying to hide their identities, the company recommends not adding publicly known phone numbers or email addresses to accounts. It also suggests adding two-factor authentication.
All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
