Twitter Data Breach (2022): What Was Exposed & What To Do

In January 2022, Twitter disclosed that a platform vulnerability had allowed an attacker to compile a database of user information covering 6.7 million accounts. The incident involved email addresses or phone numbers paired with publicly visible profile details, and the company stated it would notify affected users directly.

The event is notable because it exposed contact information that many users treat as private, even when other profile elements are public. Twitter later clarified that the underlying bug had been introduced in June 2021.

What happened

Twitter reported the incident on 1 January 2022. The company described a vulnerability that permitted an attacker to construct a dataset containing either an email address or a phone number for each affected account, together with the username, display name, bio, geographic location and profile photo. The dataset covered 6.7 million unique email addresses. Twitter stated that the flaw originated from a code change made in June 2021 and that it began notifying impacted users after the disclosure.

Further technical details about the method of access, the duration of the activity and the identity of the actor were not released in the public notice.

How a breach like this happens

Incidents of this type often stem from flaws in application logic that allow automated queries to retrieve user records at scale. When an endpoint or feature inadvertently returns contact details alongside public profile fields, an attacker can iterate through identifiers to assemble large datasets without triggering conventional rate limits or authentication checks.

Once collected, such data can be stored and later shared or sold. Organisations may discover the activity only after external reports or internal log reviews, because the queries can resemble normal user behaviour until the volume becomes apparent.

About Twitter

Twitter operates a public social-media platform where individuals and organisations post short messages and maintain profile pages. The service stores account identifiers, contact details supplied during registration or verification, and optional profile information such as biographies and locations.

Because the platform is used for personal communication, professional networking and public discourse, the contact data it holds can link online identities to offline channels. A large-scale exposure of these records therefore affects both individual users and the broader trust placed in the service.

What was likely exposed

The company reported that the dataset included email addresses or phone numbers together with usernames, display names, bios, geographic locations and profile photos. It confirmed that 6.7 million unique email addresses were present in the material obtained by the attacker.

Twitter did not publish a complete inventory of every field accessed or confirm whether additional internal records were involved. Organisations of this kind routinely hold further data such as login timestamps, device information and private messages, but no evidence has been presented that those categories were included in this incident.

Why it matters

Contact details paired with public profile information can be used for targeted unsolicited messages or to cross-reference accounts across other services. Individuals whose phone numbers or email addresses appear in such datasets may experience an increase in spam or attempts to reset passwords on unrelated sites.

For the organisation, the incident highlights the difficulty of preventing enumeration of user records when profile data is intentionally visible. It also illustrates the time that can elapse between the introduction of a code change and the discovery of its unintended consequences.

If your data was in this breach

Review any direct notification from Twitter and consider updating the email address or phone number associated with the account if you have not already done so. Enable additional login protections such as two-factor authentication that does not rely solely on SMS.

Monitor the primary email account for unusual activity and use a password manager to ensure credentials are unique across services. Readers can run a free exposure scan of their email address against known breach datasets to check for appearances in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.