Hackread.com has seen samples of data that show the information includes top celebrity and political figures such as Salman Khan from Bollywood and Democratic Rep. Alexandria Ocasio–Cortez.
A threat actor claiming to be “Ryushi,” sold more than 400,000,000 Twitter user’s personal information on BreachedForums. This cybercrime forum was created as an alternative to now-seized Raidforums .
Hackread.com has shown that the attached sample data contains usernames, followers, creator dates and creation dates. In some cases, it even includes the phone number.
Also included in the sample data are well-known accounts such as Alexandria Ocasio Cortez (New York Democratic Rep.), Salman Khan, Indian actor, and Brian Krebs, cybersecurity reporter.
Notable is the fact that this latest data breach occurred just one month ago when a hacker accessed the personal and contact information of more online. The Irish authorities are currently both the previous and most recent incidents.
In the threat actor’s post, he stated that data was “scraped through a vulnerability”, but didn’t provide any additional details.
They also openly advised Elon Musk the CEO of social media giant Facebook that the hacker should be purchased directly instead of paying $276 million USD GDPR breach penalties like Facebook. However, it does not indicate a price for the data being sold.
The threat actor offered to broker the deal through a middleman. He stated, “After that I will remove the thread and will never sell this information again.” Data will not be sold to any other person, which will prevent a lot celebrities and politicians from Phishing and Crypto scams Sim swapping and Doxxing and other activities that could make users distrust you and slow down the company’s growth.
According to researchers who saw the data, the alleged leak was caused by an API flaw that allowed the threat actor search all email addresses and phone numbers in order to return a profile.
The attack came just months after Twitter had entered into an consent agreement with US Federal Trade Commission, requiring it to keep a program of information and privacy security for the next 20 years.
This agreement ends a federal probe into Twitter’s use phone numbers and email addresses to advertise. They were used to authenticate multi-factor authentication. Twitter was also fined $150 million.
If this data breach was confirmed, it would have a severe impact on Twitter, both socially and financially. The data were still available at the time this article was written.