X (Twitter) — Data Breach

A database containing email addresses, names, and usernames of over 200 million Twitter users was published on BreachForums. The data was scraped using an API vulnerability introduced in June 2021 that allowed anyone to look up accounts by phone number or email. An earlier dataset of 5.4 million records had been sold for $30,000 in July 2022. The mass exposure posed major phishing and deanonymization risks for activists, journalists, and dissidents. Twitter did not issue a public disclosure.