Researcher says he was able to match 17M phone numbers to Twitter user accounts by exploiting a flaw in Twitter's Android app, before Twitter blocked his effort
A security researcher said he has matched 17 million phone numbers to Twitter user accounts by exploiting a flaw in Twitter's Android app.
Context & Ripple Effects
This is the third time in roughly a year that Twitter's phone-number plumbing has surfaced as an attack surface. In late 2018, researchers hijacked celebrity accounts by exploiting a UK mobile-number binding from a bug Twitter had downplayed since 2012. Now a researcher says he chained a flaw in Twitter's Android app to match 17 million phone numbers to user accounts before Twitter cut off the effort.
The arc matters because it did not end in 2019: in August 2022 Twitter confirmed a now-patched bug had been used to link phone numbers and emails to accounts, after a threat actor offered 5.4M records for sale in December 2021. The 17M match looks, in hindsight, like an early demonstration of the same de-anonymization technique that later became a monetized data sale.
First-order effects
- Twitter moved to block the researcher's enumeration, but the matching method — chaining account lookups through the Android app — was demonstrated at scale, meaning 17 million users' phone-number-to-account links were exposed to whoever replicated it before the block.
- The researcher's disclosure puts Twitter in the position of validating a third phone-number flaw in the coverage window, on top of the 2012-era number-binding bug that resurfaced in 2018.
Second-order effects
- The 2022 confirmation that a similar bug fed a 5.4M-record sale shows the knock-on path: enumeration flaws become scraped datasets that threat actors package and offer for sale, converting a security bug into a doxxing and targeting commodity.
- Each confirmed incident raises the cost of Twitter's phone-number-based account features, pressuring the platform to weigh mandatory lookup surfaces against the de-anonymization risk they create.
Third-order effects
- If the pattern holds — 2012 bug, 2018 hijack, 2019 mass matching, 2022 confirmed sale — phone-number-to-account linkage is a structural weak point of identity systems built on mobile numbers, and platforms that keep lookup endpoints open should expect repeated de-anonymization at dataset scale.
- Recurring confirmed breaches of this kind feed regulatory and advertiser scrutiny of the platform's data handling, a pressure that compounds alongside the ecosystem-health concerns already attached to Twitter in the coverage.
The trend: Twitter's phone-number-to-account linkage keeps re-emerging as a de-anonymization vector, turning a decade of unpatched lookup surfaces into scraped, sellable user datasets.