Twitter

Twitter suffered a data breach incident after a threat actor compiled a list of 5.4 million user account profiles by exploiting a now-patched zero-day vulnerability that was used to link email addresses and phone numbers to users' accounts.

This vulnerability allowed anyone to submit an email address or phone number, verify if it was associated with a Twitter account, and retrieve the related account ID.

The threat actor verified phone number or email address, and scraped public information, such as follower counts, screen name, login name, location, profile picture URL, and other information, and sold the data for $30,000.

Source: https://www.bleepingcomputer.com/news/security/twitter-confirms-zero-day-used-to-expose-data-of-54-million-accounts/

TPRM report: https://scoringcyber.rankiteo.com/company/twitter

"id": "twi0499822",
"linkid": "twitter",
"type": "Breach",
"date": "08/2022",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of a geographical region"

{'affected_entities': [{'customers_affected': '5.4 million user accounts',
                        'industry': 'Technology',
                        'name': 'Twitter',
                        'type': 'Social Media Platform'}],
 'attack_vector': 'Zero-day vulnerability',
 'data_breach': {'data_exfiltration': True,
                 'number_of_records_exposed': '5.4 million',
                 'personally_identifiable_information': ['Email addresses',
                                                         'Phone numbers'],
                 'type_of_data_compromised': ['Personal Information']},
 'description': 'Twitter suffered a data breach incident after a threat actor '
                'compiled a list of 5.4 million user account profiles by '
                'exploiting a now-patched zero-day vulnerability that was used '
                "to link email addresses and phone numbers to users' accounts.",
 'impact': {'data_compromised': ['Email addresses',
                                 'Phone numbers',
                                 'User account profiles',
                                 'Follower counts',
                                 'Screen name',
                                 'Login name',
                                 'Location',
                                 'Profile picture URL']},
 'initial_access_broker': {'data_sold_on_dark_web': True,
                           'entry_point': 'Zero-day vulnerability'},
 'motivation': 'Data scraping and selling',
 'post_incident_analysis': {'root_causes': 'Zero-day vulnerability'},
 'title': 'Twitter Data Breach Incident',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Vulnerability allowing linkage of email addresses '
                            'and phone numbers to Twitter accounts'}