Information about 200 million Twitter users (including email addresses) was published on a popular hacker forum for just $2.
The journalists were able to confirm the authenticity of many email addresses from this dump.Starting in the summer of 2022, attackers have been selling or distributing for free large sets of Twitter user data containing both private (phone numbers and email addresses) and public information. These ladies appeared due to the eltoloitation of a vulnerability in the Twitter API, which allowed to enter different email addresses and phone numbers to find out if they are associated with any Twitter ID.
The problem, which was fixed back in January 2022, was used to scrape the data of social network users, and as a result, large dumps collected a year ago began to appear on hack forums and underground marketplaces.
So, the first major “drain” occurred in July last year, when information about 5.4 million Twitter users appeared on sale. At the end of November, the same data was published online for free. In addition, at the end of December, the data of 400 million social network users collected using the same vulnerability appeared on sale.
As Bleeping Computer now reports, over the holidays, another attacker published on the well-known hack forum Breached another large data set containing information about 200 million Twitter profiles (6 text files, totaling 59 GB). The attacker valued this dump at 8 units of the forum’s internal currency (approximately $2).
This dump appears to be similar to the previous 400 million user data dump, but it was cleared of duplicates, reducing the total data to 221,608,279 lines, including email addresses, names, nicknames, number of subscribers, and date of creation accounts.
However, tests conducted by Bleeping Computer journalists confirmed that there are still duplicates in the data set. The researchers were also able to confirm the validity of a number of email addresses from this dump.
Troy Hunt, creator of the Have I Been Pwned leak aggregator, says he has already added the latest leak to his database and has started notifying subscribers whose email addresses were found in the dump.
According to Hunt, the leak contains a total of 211,524,284 unique email addresses (compared to the original 221,608,279 lines).
