A filtration of data from more than 200 million users Twitter was posted on a forum for buying and selling personal data for $2. The information stolen included phone numbers, email addresses, and other personal data. Various cybersecurity media outlets have confirmed the legitimacy of several emails.
Since July 22 of last year, various threat actors and leakers have been selling and distributing large datasets of Twitter user profiles containing both private data (phone numbers and email addresses) and public data on various forums. hackersas well as various cybercrime markets.
These datasets were created in 2021 by exploiting a vulnerability in the Twitter API (commonly known as an exploit), which allowed users to enter email addresses and phone numbers to confirm if they were associated with a Twitter ID.
Threat actors then used another API to “scrub” Twitter’s public data for identification and combined this public data with private email addresses and phone numbers to Create user profiles on Twitter.
While Twitter fixed this flaw in January 2022, several threat actors recently began leaking datasets collected more than a year ago for free.
The datasets
The first data set of 5.4 million users it went on sale in July for $30,000 and was finally released for free on November 27, 2022. Another dataset allegedly containing data from 17 million users was also privately circulating in November.
All of this information was first “cured” by deleting data from 400 million Twitter profiles affected by this vulnerability.
This week, a threat actor released a dataset consisting of 200 million profiles from Twitter for an approximate value of $2.
This dataset is presumably the same as the 400 million that circulated in November, but has been scrubbed to contain no duplicates, bringing the total to around 221,608,279 rows. However, there is still duplicate data there as well.
The data was published as a RAR archive consisting of six text files for an overall size of 59GB of data.
Each line in the files represents a Twitter user and their data, including email addresses, names, number of followers, and account creation dates.
Unlike previously leaked data collected with this Twitter API flaw, today’s leak does not indicate whether accounts are verified. It probably has to do with the changes Elon Musk made to the platform verification system in the last few months of last year.
What to do in case of a data breach
While the only way to know if your data has been leaked is to review the information file, experts suggest acting as if the user has been leaked.
In this sense, the key measure is to always have the second factor of authentication turned on, so that when a threat actor tries to access an account that is not their own, they run into this restriction.
On the other hand, it never hurts to change your password beforehand. In this sense it is better to use secure keys such as those generated by key managers.
SL
Source: Clarin
Linda Price is a tech expert at News Rebeat. With a deep understanding of the latest developments in the world of technology and a passion for innovation, Linda provides insightful and informative coverage of the cutting-edge advancements shaping our world.