Twitter says it found no evidence hackers gained access to user passwords but is locking accounts that reset passwords in past 30 days
Catalin Cimpanu / ZDNet : Tweets: @tayhatmaker , @oneunderscore__ , @billt , and @zackwhittaker Tweets: Taylor Hatmaker / @tayhatmaker : still no assurance that DMs weren't compromised https://twitter.com/... Ben Collins / @oneunderscore__ : This doesn't really matter if they had full access to private message data, and it appears the hackers did. https://twitter.com/... Bill Thompson / @billt : Anyone who sends anything potentially confidential, sensitive, or even just vaguely embarrassing via Twitter DM is simply reckless. https://twitter.com/... Zack Whittaker / @zackwhittaker : New: Twitter says there is “no evidence” that the hackers, who broke into its internal network yesterday to spread a cryptocurrency scam, had access to user passwords. But the company is declining to say if user direct messages were accessed or read. https://techcrunch.com/...
Context & Ripple Effects
This is day-two coverage of the July 2020 hijacking of 130 high-profile Twitter accounts: the company is reassuring users that passwords were not taken while quietly force-resetting anyone who changed their password in the past 30 days. Reporters on the story — Taylor Hatmaker, Ben Collins, Bill Thompson, Zack Whittaker — flagged immediately that the password claim sidesteps the real question: whether hackers read private direct messages, which Twitter's 2018 unmasked-password bug disclosure had already shown to be a weak point in its security posture.
Twitter declined to say whether DMs were accessed or read, and the skepticism proved warranted: within a week the company confirmed hackers reached the DM inbox for up to 36 of the 130 targeted accounts. That makes the 'no evidence' framing here part of a longer pattern — similar reassurances followed the 2016 credential dump scare and recur as recently as the 2023 investigation into user data sold online.
First-order effects
- Users who reset their passwords in the prior 30 days find their accounts locked pending re-verification, an immediate availability cost imposed on the very people who acted most cautiously.
- The named reporters covering the breach shift the story's center of gravity from stolen passwords to unreadable DM exposure, pressuring Twitter to answer questions it has explicitly declined to.
Second-order effects
- Twitter's refusal to confirm or deny DM access forces journalists and security researchers to treat 'no evidence' statements as provisional, raising the verification burden on every subsequent company statement.
- High-profile account holders — the attack's actual targets — face a new calculus about conducting sensitive conversations over Twitter DMs, since the company itself cannot vouch for message privacy during an incident.
Third-order effects
- If each incident closes with a partial 'no evidence' disclosure followed by a later confirmation of deeper access, platform trust migrates away from self-reported assurances toward independent verification, and regulators gain a standing template for questioning what companies choose not to disclose.
- Private messaging inside public platforms becomes the structural weak point: the same DM systems that keep users engaged concentrate sensitive data that attackers value more than credentials.
The trend: Platform breach disclosures are converging on a pattern where initial 'no evidence' reassurances are progressively walked back, making direct-message privacy — not credential theft — the durable trust question for social platforms.