On August 5, 2022, Twitter confirmed it has suffered a data breach after receiving a report of a vulnerability through its HackerOne bug bounty program in January 2022. Twitter explained that “if someone submitted an email address or phone number to Twitter’s systems, Twitter’s systems would tell the person what Twitter account the submitted email addresses or phone number was associated with, if any.” This vulnerability was patched on January 13, 2022; Twitter added that there was no evidence that the vulnerability had been exploited at the time of patching. A threat actor, however, posted in a hacking forum on July 21, 2022, that they were able to compile a list of approximately 5.4 million Twitter account profiles using the vulnerability in December 2021. The collected data includes a user’s verified phone number or email address as well as scraped public data, which could include follower count, login name, screen name, profile picture URL, location, and more. BleepingComputer confirmed on August 5, 2022, that two (2) additional threat actors have purchased the data for less than $30,000 and that the data will likely be released in the future for free. To mitigate the risk of users’ information being compromised, Twitter recommends “not adding a publicly known phone number or email address,” in order to keep their identities concealed (aka burner contact information). Twitter also added that it is “particularly mindful of people with pseudonymous accounts who can be targeted by state or other actors” and that all users should enable two-factor authentication as an additional safety precaution.