Twitter Data Leak from Before Elon Musk's Takeover Reveals User Data of 5.4 Million Accounts

Earlier this year Twitter revealed that the private data of 5.4 million users was stolen due to an API vulnerability — now the data leaked before Elon Musk took the company private has been exposed on a hacker forum, according to a recent report.

BleepingComputer reports that earlier this year, Twitter stated that an API flaw had resulted in the theft of user data for 5.4 million accounts, but that it had “no evidence” that anyone had accessed the data. Now those accounts have reportedly been exposed on a hacker forum.

Elon Musk (Win McNamee/Getty Images; BNN)

In August of 2022, Twitter confirmed that a vulnerability in its code led to the exposure of data of anonymous users on the platform. Private user data on more than 5.4 million accounts was accessed before the company patched the bug that let malicious actors into the system.

An additional 1.4 million Twitter profiles belonging to suspended users were also reportedly shared privately, and a larger data dump containing the information of “tens of millions” of users may have come from the same API vulnerability.

The individual who runs the hacking forum, known as “Breached,” revealed to BleepingComputer that it was responsible for taking advantage of the flaw and dumping the records. The owner said that the vulnerability was originally discovered by another hacker named “Devil.” He claimed that he also obtained 1.4 million Twitter profiles for suspended accounts via another API, but this vulnerability was only shared privately with a few individuals.

Leftist security expert Chad Loder recently revealed that tens of millions more Twitter records could have been collected using the same AP vulnerabilities. Data collected may include private phone numbers alongside public information. Loder posted a redacted sample of the data on Mastodon as he was banned on Twitter days ago for unknown reasons. Loder said that the data could include 17 million records.