Twitter twitter.com Twitter data breach 2022: what happened and what to do
A flaw in Twitter's API let anyone look up the account tied to an email address or phone number. It was exploited before a January 2022 fix. Have I Been Pwned counts 6,682,453 accounts with emails, phone numbers, names, usernames, locations, bios and profile photos.
View all 13,115 breaches- Breach date
- Jan 2022
- Made public
- 5 Aug 2022
- Affected
- 6,682,453
- Data exposed
- Bios, Email addresses, Geographic locations, Names, Phone numbers, Profile photos, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
This page covers the scraped Twitter data that Have I Been Pwned (HIBP) lists as "Twitter", dated January 2022 and added on August 13, 2022. A larger, separate set from the same flaw has its own page.
What happened
In August 2022 Twitter said that, between June 2021 and January 2022, a flaw in its systems let anyone submit an email address or phone number and learn which account it belonged to. Twitter received a report of the flaw through its bug bounty program in January 2022 and fixed it.
Before the fix, someone used the flaw to build a large collection of profiles that joined public information with private email addresses and phone numbers. Twitter said that collection covered about 5.4 million accounts. It was offered for sale in mid-2022, and a bigger version was later released. HIBP's copy holds 6,682,453 accounts, which is the figure this page uses.
What was exposed
HIBP lists these data types:
- Email addresses
- Phone numbers
- Names and usernames
- Geographic locations
- Bios and profile photos
Twitter said it had no evidence that passwords or direct messages were taken. This was scraping through a bug, not a break-in to the password database.
Why a phone-to-account link matters
Many people keep their Twitter account separate from their real name. The flaw broke that. If you ran an anonymous or pseudonymous account, someone with this data could connect it to your email address or phone number, which can lead to your real identity.
For everyone else, it's a contact list: real emails and phone numbers paired with names, which is exactly what phishers and scam callers buy.
What criminals can do with it
Expect phishing that uses your name and username, and texts that refer to your account. Attackers may also try a SIM swap using your phone number, or use your email to attempt password resets across other services. Without a password in the data, they can't log in to your accounts directly.
Twitter's response
Twitter published a notice in August 2022 describing the flaw. The company said it had fixed it in January 2022 after a bug bounty report, and that it had no evidence passwords were taken. Reports at the time said the Irish Data Protection Commission and the US Federal Trade Commission were looking into the incident.
Serus can't take scraped data off the internet. It monitors breach databases and the dark web for your email, phone number and username, and alerts you when they show up. The steps below are the ones that count.
How to check your own exposure
Search your email address and your phone number on Have I Been Pwned, which is free and doesn't ask for a password. Try every address you've used for the account, including old ones, since the flaw matched whichever email or phone number someone submitted.
What to do if you were in it
- 1
Turn on two-factor authentication on X
Choose an authenticator app or a security key rather than text messages, since your phone number is part of the leaked data.
- 2
Expect phishing and texts that mention your account
Your name, username, email and phone number were exposed together. Don't open links in unexpected messages that claim to be from X.
- 3
Protect your phone number
Ask your mobile carrier to add a PIN or passcode for SIM changes and number transfers, which makes SIM swapping harder.
- 4
Reconsider what's linked to a pseudonymous account
If you posted anonymously, review which email address and phone number are tied to the account. Use a separate email address only for that account.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures without searching for them.
Frequently asked
Was my account in the 2022 Twitter breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 6,682,453 accounts in this set.
What was exposed?
Email addresses, phone numbers, names, usernames, locations, bios and profile photos, according to HIBP. Passwords were not part of it.
Is there a settlement?
The sources used here mention a lawsuit and regulator interest, but no settlement.
Should I change my password?
Passwords weren't exposed, so a change isn't required. Two-factor authentication is the more useful step.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
