Twitter twitter.com Twitter 200M data breach: what happened and what to do
In January 2023, a file of email addresses tied to more than 200 million Twitter accounts was posted online. It came from a 2021 API flaw that Twitter fixed in January 2022. Have I Been Pwned counts 211,524,284 accounts with emails, names, usernames and profile links.
View all 13,115 breaches- Breach date
- Jan 2021
- Made public
- 5 Jan 2023
- Affected
- 211,524,284
- Data exposed
- Email addresses, Names, Social media profiles, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
This is the larger of two Twitter datasets in Have I Been Pwned (HIBP). It's dated January 2021 and was added on January 5, 2023. The earlier, smaller set is covered on its own page.
What happened
Twitter had an API bug, introduced in a June 2021 code update, that let someone submit an email address or phone number and get back the matching account. Twitter said it fixed the bug in January 2022. In the meantime, data collected through it circulated in several rounds. A set covering about 5.4 million accounts was sold in mid-2022. Then, in early January 2023, a file of more than 200 million email addresses appeared online, offered for a few dollars.
The January 2023 file was a cleaned-up version of an earlier collection of around 400 million records that contained many duplicates. HIBP's copy holds 211,524,284 accounts. That's the number to use. Researchers put other counts on the underlying data, which is why you'll see different figures in news stories.
What was exposed
HIBP lists these data types:
- Email addresses
- Names
- Usernames
- Social media profiles
Reporting adds that records can include screen names, account creation dates and follower counts. News coverage confirmed that many of the addresses were valid. Passwords weren't part of the data.
What criminals can do with it
An email address paired with a real name and a Twitter handle is a ready-made target list. Phishing becomes easier, because the message can open with your name and refer to your account. Scammers also use these lists to send fake "your account has been suspended" messages.
The other risk is de-anonymization. If you ran an account under a pseudonym with a private email address, anyone holding this file can link that email to the account.
Twitter's response
Twitter's public statements tied the leaked data to the API vulnerability it had already described in August 2022 and fixed. Reports also noted a regulator inquiry by the Irish Data Protection Commission.
What to take from it
Scraped data isn't the same as a password breach, but the harm is real in a different way. You can't change your email address as easily as a password, so the useful steps are making the address less valuable and watching for abuse.
Serus can't remove breach data, because it's spread across files that were copied. What Serus does is monitor breach databases and the dark web for your email and other details, and alert you if they appear. The steps below are the most useful actions.
How to check your own exposure
Search your email address on Have I Been Pwned, which is free and doesn't ask for a password. Try each address you've used for Twitter or X, including old ones. If it's listed, the address is tied to your username and name in the leaked file.
What to do if you were in it
- 1
Turn on two-factor authentication on X
Use an authenticator app or a security key. Even though passwords weren't leaked, attackers who know your email can try to reset or guess.
- 2
Treat messages about your account as suspect
Fake suspension, verification and copyright notices use leaked emails. Go to the app or type the address yourself rather than clicking a link.
- 3
Use a separate email address for accounts you want kept private
If you run an anonymous account, switch it to an address that's not linked to your name, and avoid using it elsewhere.
- 4
Use unique passwords everywhere
If you reuse passwords, one phishing success could open several accounts. A password manager handles this for you.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures without searching for them.
Frequently asked
Is my email in the Twitter 200M data?
Check on Have I Been Pwned or run a free Serus scan. HIBP lists 211,524,284 accounts in this set.
What was exposed?
Email addresses, names, usernames and social media profiles, according to HIBP. Passwords weren't included.
Is there a settlement?
The sources used here report regulator inquiries but no settlement for this dataset.
Should I change my password?
A password change isn't required for this dataset. Turning on two-factor authentication is the more useful step.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
