Twitter, Even More Open Than We Wanted
About a month ago, an administrative employee here at Twitter was targeted and her personal email account was hacked. From the personal account, we believe the hacker was able to gain information which allowed access to this employee's Google Apps account …
Context & Ripple Effects
Twitter's disclosure lands at a moment when the company is running its operations heavily on hosted tools — no wait, grounded strictly in mid-2009 coverage: the blog post itself confirms an administrative employee's personal email was compromised and used to reach her Twitter Google Apps account, while TechCrunch's syndicated take adds a second failure point by noting weak server passwords were also in play. MediaMemo's headline ('Don't Blame Google') captures the frame the story is fighting over: whether the fault sits with the SaaS provider or with password hygiene across personal and work accounts.
First-order effects
- Twitter has to audit everything stored in that employee's Google Apps workspace — internal documents and forecasts that were meant to stay private are now exposed, which is why leaked internal projections (including rumored user-growth and Q3 revenue figures) are already circulating alongside the breach story.
- Google Apps takes reputational damage it did not cause directly: the entry point was the employee's personal email, forcing Google and Twitter to defend the distinction between a compromised consumer mailbox and a breached corporate suite.
Second-order effects
- Companies adopting hosted suites have to confront credential chaining — one reused or recoverable personal password reaching deep into corporate data — pushing password managers, stronger recovery flows, and separation of personal and work identities up the priority list.
- SaaS vendors like Google face pressure to harden account-recovery paths, because their value proposition (anywhere access) is exactly what converts a single phishing victim into a document leak.
Third-order effects
- If cloud suites keep replacing on-premise servers as default corporate infrastructure, the security perimeter shifts from the network to the individual account — identity and access control becomes the industry's core defensive layer.
- A pattern where one low-level employee's mailbox yields high-value internal documents points toward structural changes: least-privilege access policies and executive-level scrutiny of what ordinary staff accounts can reach.
The trend: As businesses migrate to hosted cloud suites, personal-account compromise becomes a direct corporate-breach vector, making identity and access management the new security perimeter.