Twitter data dump: 200m+ account database now free to download
(2023/01/05)
- Reference: 1672954215
- News link: https://www.theregister.co.uk/2023/01/05/twitter_leak_200m_accounts/
- Source link:
More than 200 million Twitter users' information is now available for anyone to download for free.
This [1]latest data dump , which includes account names, handles, creation dates, follower counts, and email addresses, turns out to the be same — albeit cleaned up — leak reported last month that affected [2]more than 400 million Twitter accounts, according to Privacy Affairs' security researchers, who verified the database that's now posted on a breach forum.
The halved number of accounts is due to the removal of duplicates, according to Privacy Affairs CEO and founder Miklos Zoltan. "However, this time, the data is available for anyone to download for free, instead of being listed for sale at $200,000, as it was in December," he [3]wrote .
[4]
Some of the well-known people and organizations included in the new 63GB database leak include Donald Trump Jr., Google CEO Sundar Pichai, SpaceX, the US National Basketball Association, CBS Media and the World Health Organization, according to Zoltan's blog post about the breach.
[5]
[6]
No word on whether the Christmas day hack of British education secretary Gillian Keegan's Twitter account is related. In that case miscreants took over Keegan's account, [7]changed her profile picture to Elon Musk , and posted a series of tweets promoting cryptocurrencies.
Twitter did not respond to The Register 's inquiries.
[8]Stolen info on 400m+ Twitter accounts seemingly up for sale
[9]More pre-Musk Twitter 1.0 execs leave the building
[10]Twitter whistleblower Peiter 'Mudge' Zatko lands new gig at Rapid7
[11]Elon Musk's cost-cutting campaign at Twitter extended to not paying rent, claims landlord
While the leaked data does not include users' phone numbers, physical addresses or passwords, it still poses a risk to the exposed account owners, Zoltan said.
"Privacy Affairs cybersecurity experts reviewed the published data and believe this latest leak could lead to social engineering attacks and doxxing."
[12]
The leaked email addresses linked to Twitter accounts can be combined with other publicly available information to determine users' real-life identity and locations. Plus, phishing emails continue to provide a successful entry point for criminals — and [13]nation state thugs — looking to pull off social engineering attacks.
Of course, the published email addresses can also be used by spammers or scam markers, and all they need to do is convince one victim to click on a malicious link.
While this week's data dump contains fewer accounts, it could prove to be more serious because the crooks are giving away the full database for free, researchers warned.
[14]
"It is not certain at this moment how exactly this data was obtained," Zoltan noted. "The most likely method used could have been the abuse of an application programming interface (API) vulnerability."
As previously reported, the records were apparently scraped in 2021 via a [15]security flaw Twitter said it fixed last year. ®
Get our [16]Tech Resources
[1] https://breached.vc/Thread-Twitter-200M-Scrape-Leak-FIXED-in-csv
[2] https://www.theregister.com/2022/12/27/twitter_hack_morgan/
[3] https://www.privacyaffairs.com/200-million-twitter-data-leak/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theguardian.com/technology/2022/dec/26/hack-of-twitter-uk-education-secretary-gillian-keegan-changes-profile-picture-elon-musk
[8] https://www.theregister.com/2022/12/27/twitter_hack_morgan/
[9] https://www.theregister.com/2023/01/05/more_premusk_leaders_leave_twitter/
[10] https://www.theregister.com/2023/01/05/zatko_rapid7/
[11] https://www.theregister.com/2023/01/03/elon_musks_costcutting_campaign_at/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2022/12/15/charming_kitten_ta453_expands_targets/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2022/07/25/twitter_investigates_data_breach/
[16] https://whitepapers.theregister.com/
This [1]latest data dump , which includes account names, handles, creation dates, follower counts, and email addresses, turns out to the be same — albeit cleaned up — leak reported last month that affected [2]more than 400 million Twitter accounts, according to Privacy Affairs' security researchers, who verified the database that's now posted on a breach forum.
The halved number of accounts is due to the removal of duplicates, according to Privacy Affairs CEO and founder Miklos Zoltan. "However, this time, the data is available for anyone to download for free, instead of being listed for sale at $200,000, as it was in December," he [3]wrote .
[4]
Some of the well-known people and organizations included in the new 63GB database leak include Donald Trump Jr., Google CEO Sundar Pichai, SpaceX, the US National Basketball Association, CBS Media and the World Health Organization, according to Zoltan's blog post about the breach.
[5]
[6]
No word on whether the Christmas day hack of British education secretary Gillian Keegan's Twitter account is related. In that case miscreants took over Keegan's account, [7]changed her profile picture to Elon Musk , and posted a series of tweets promoting cryptocurrencies.
Twitter did not respond to The Register 's inquiries.
[8]Stolen info on 400m+ Twitter accounts seemingly up for sale
[9]More pre-Musk Twitter 1.0 execs leave the building
[10]Twitter whistleblower Peiter 'Mudge' Zatko lands new gig at Rapid7
[11]Elon Musk's cost-cutting campaign at Twitter extended to not paying rent, claims landlord
While the leaked data does not include users' phone numbers, physical addresses or passwords, it still poses a risk to the exposed account owners, Zoltan said.
"Privacy Affairs cybersecurity experts reviewed the published data and believe this latest leak could lead to social engineering attacks and doxxing."
[12]
The leaked email addresses linked to Twitter accounts can be combined with other publicly available information to determine users' real-life identity and locations. Plus, phishing emails continue to provide a successful entry point for criminals — and [13]nation state thugs — looking to pull off social engineering attacks.
Of course, the published email addresses can also be used by spammers or scam markers, and all they need to do is convince one victim to click on a malicious link.
While this week's data dump contains fewer accounts, it could prove to be more serious because the crooks are giving away the full database for free, researchers warned.
[14]
"It is not certain at this moment how exactly this data was obtained," Zoltan noted. "The most likely method used could have been the abuse of an application programming interface (API) vulnerability."
As previously reported, the records were apparently scraped in 2021 via a [15]security flaw Twitter said it fixed last year. ®
Get our [16]Tech Resources
[1] https://breached.vc/Thread-Twitter-200M-Scrape-Leak-FIXED-in-csv
[2] https://www.theregister.com/2022/12/27/twitter_hack_morgan/
[3] https://www.privacyaffairs.com/200-million-twitter-data-leak/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theguardian.com/technology/2022/dec/26/hack-of-twitter-uk-education-secretary-gillian-keegan-changes-profile-picture-elon-musk
[8] https://www.theregister.com/2022/12/27/twitter_hack_morgan/
[9] https://www.theregister.com/2023/01/05/more_premusk_leaders_leave_twitter/
[10] https://www.theregister.com/2023/01/05/zatko_rapid7/
[11] https://www.theregister.com/2023/01/03/elon_musks_costcutting_campaign_at/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2022/12/15/charming_kitten_ta453_expands_targets/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y7dWjPQR5moz66ykplaS0QAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2022/07/25/twitter_investigates_data_breach/
[16] https://whitepapers.theregister.com/
Re: What dump?
doublelayer
I'm not sure what URL you were using. I wouldn't be surprised to hear that it's been uploaded to a bunch of places recently and that all of them will eventually take it down following complaints, so unless you were using the original leak which is probably somewhere on a Tor hidden service, you're likely to have to hunt to find the database. Remember that it's not public information, and depending on where you are, it may be illegal for you to possess it.
Uh-huh, right
Doctor Evil
So, the breach dump file is inaccessible without first registering/logging in. All they want is a username, password (hopefully not re-used, right?), and an email address. And then you can have access to the data.
Except ... I don't know who's behind breached.vc -- so why would I trust them? What a great way to harvest live/active email accounts, possibly with a useful password (for the lazy).
Anyone else want to be the guinea pig here?.
What dump?
The URL gives 404.... is the URL correct?
I was expecting a DDOS error, so "not found" was surprising.