Twitter provides an overview of what it knows about Wednesday's hack so far: how it happened, what the attackers accessed, how it reacted, and the next steps

As we've been informing via the @TwitterSupport account, on Wednesday, July 15, 2020, we detected a security incident at Twitter and took immediate action.

Twitter 2020-07-19

Context & Ripple Effects

Twitter's postmortem lands two days after the company first disclosed the breach through @twittersupport threads attributing it to a [[a:955796|coordinated social engineering attack against employees with access to internal systems and tools]]. Those earlier updates also established that roughly 130 accounts were affected, with attackers controlling only a small subset long enough to send tweets.

What changes today is granularity: this overview walks through how the attack worked, what the attackers actually accessed inside those accounts, how Twitter reacted mid-incident, and what it says comes next — turning an ongoing crisis thread into a formal account of the failure. It sets up Wired's later examination of the drastic changes made in the immediate aftermath and the company's push to prevent an Election Day repeat.

First-order effects

Employees holding access to internal systems and tools are now the confirmed attack surface, meaning Twitter must rework who can touch account-control tooling rather than just patch an external vulnerability.
The roughly 130 affected accounts — and the smaller subset whose tweets were hijacked — face direct fallout, from compromised communications to whatever attacker-accessed data the overview details.

Second-order effects

Rivals and platforms with similar verified-account tooling face pressure to audit their own internal access controls, since Twitter's breach showed a handful of phished employees can compromise high-profile accounts at scale.
Twitter's own product and moderation posture shifts in response — the drastic post-incident changes Wired documents show a security event translating directly into platform policy, tightening features around high-value accounts heading into the election.

Third-order effects

If the pattern holds, large platforms will treat internal admin tools as the primary security perimeter, with insider-focused controls like least-privilege access and hardened employee authentication becoming standard infrastructure rather than best practice.
A breach of this visibility ahead of a US election strengthens the case for regulators and policymakers to scrutinize platform security practices for politically sensitive infrastructure, not just user-data privacy.

The trend: Platform security is moving from defending the network edge toward treating privileged internal tools and the employees who hold their keys as the main battleground, with election-critical services raising the stakes.

Discussion

@twittersupport @twittersupport on x
There is a lot speculation about the identity of these 8 accounts. We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts.
@twittersupport @twittersupport on x
Based on what we know right now, we believe approximately 130 accounts were targeted by the attackers in some way as part of the incident. For a small subset of these accounts, the attackers were able to gain control of the accounts and then send Tweets from those accounts.
@normative Julian Sanchez on x
This is pretty weird. So the attackers exfiltrated private information from 8 of the accounts they hacked... but NOT the huge prominent political & business figures (who are all verified accounts)? Why not, if they were downloading user data at all? And why the 8 they did? https:…
@pinboard @pinboard on x
Cloudflare and Twitter are demonstrating something I learned ages ago with Pinboard—no one cares how bad you fuck up if you are good enough at apologizing and projecting sincerity. A dollar invested in good apology writing beats ten spent on prevention and planning
@nycsouthpaw Southpaw on x
“We're acutely aware of our responsibilities to the people who use our service and to society more generally. We're embarrassed, we're disappointed, and more than anything, we're sorry.” https://blog.twitter.com/...
@bzamayo Benjamin Mayo on x
This is like Twitter Cluedo https://twitter.com/...
@kateconger Kate Conger on x
Update from Twitter: Attackers could tweet from 45 of the 130 accounts they targeted. For 8 accounts, they downloaded full archive data. https://blog.twitter.com/...
@ruskin147 Rory Cellan-Jones on x
“An update on our security incident.” Most striking line “For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account's information through our “Your Twitter Data” tool.” https://blog.twitter.com/...
@twittersupport @twittersupport on x
We're sharing a blog post that collects the latest on our investigation. It reiterates what we've already shared here, and includes a few new findings. https://blog.twitter.com/...
@edzitron Ed Zitron on x
The hell dude has been compromised https://twitter.com/...
@malwaretechblog @malwaretechblog on x
Anyone happen to be or know any of the 8 accounts who were notified by Twitter that their data was stolen? https://twitter.com/...
@oneunderscore__ Ben Collins on x
Hopeful, if weird, update. https://twitter.com/...
@atrupar Aaron Rupar on x
This seems to rule out that Biden and Obama were among accounts whose data was exfiltrated, however https://twitter.com/...
@briankrebs @briankrebs on x
Twitter w/ more info on hack. A “small #” of employees “manipulated.” 130 accounts targeted, succeeded in tweeting from 45 of them & may have been able to view additional info (read: DMs). On 8 accounts, d/l'd account history using Your Twitter Data tool. https://blog.twitter.com…
@djlavoie Dan Lavoie on x
This doesn't feel like some ham-handed Bitcoin scam for a couple hundred thousand dollars. https://twitter.com/...
@ourielohayon Ouriel Ohayon on x
In under one year. 1. An employee leaving deleted briefly the twitter account of Donald trump. 2. Jack was sim jacked by social engineering 3. Mass twitter hack via internal manipulation Time to invest massively in internal opsec Twitter. https://twitter.com/...
@kayvz Kayvon Beykpour on x
We just published the latest accounting of what we know about Wednesday's security incident in a blog post. Will continue sharing updates publicly as we learn more https://twitter.com/...
@staska Stasys Bielinis on x
Damn - looking at this + NYT : https://www.techmeme.com/... All those randomly numbered APTs funded by millions of Nation States $$ must feel hugely embarrassed how script kiddies beat them to this Or crazy angry the cool scheme they had to read #Trump DMs just got exposed
@scottmstedman Scott Stedman on x
For these 8 accounts, it is the worst case scenario. Private data accessed and downloaded. Likely no way to get it back. https://twitter.com/...
@firstadopter Tae Kim on x
45 accounts were password reset and then logged in to send tweets, which also means they had full control and access to the account including DMs, no? https://blog.twitter.com/... https://twitter.com/...
@rmac18 @rmac18 on x
Twitter now confirming multiple employees were socially engineered back hackers. Still no confirmation that anyone was bribed, as previously reported. 45 accounts out of 130 accessed had passwords reset. Up to 8 had data downloaded. https://blog.twitter.com/... https://twitter.co…
@kantrowitz Alex Kantrowitz on x
The one who uses their account at volume is Elon. Can't imagine Obama spending his days sliding into DMs — though you never know. Bezos, fwiw, already has experience with his messages getting hacked. https://blog.twitter.com/...
@benlower Ben Lower on x
130? What a missed oppty. Should have been 140. https://www.cnbc.com/...
@thehill @thehill on x
Twitter says 130 accounts targeted in this week's cyberattack https://hill.cm/dYK9wOu https://twitter.com/...
@bbcnews @bbcnews on x
Twitter says 130 accounts were targeted in a major cyber-attack of celebrity accounts two days ago https://www.bbc.com/...
@reuters @reuters on x
Twitter says about 130 accounts were targeted in a cyber attack this week. The company added that it was continuing to assess whether the attackers were able to access private data of the targeted accounts https://www.reuters.com/... https://twitter.com/...
@variety @variety on x
.@Twitter Says 130 Accounts Targeted in Hack That Hijacked Feeds of Kanye, Biden, Obama, Bezos and Others http://variety.com/...
@eamonjavers Eamon Javers on x
This is interesting disclosure from Twitter, because it implies that although the attackers had access to “internal systems and tools” they weren't able to get into every account they targeted. 2 Q's: who else were they after, and: Why couldn't they get in? https://twitter.com/..…
@donie Donie O'Sullivan on x
#BREAK Twitter says approx 130 accounts targeted as part of hack. That's a lot more than the compromised accounts we know about. https://twitter.com/...
@netik John Adams on x
No one had to be sorry if DMs were encrypted and no one had to be sorry if there was a two-man rule on accounts > 10k followers. Detection should have been in place if a set of employees started issuing > N account resets over a small time window. Sigh. https://blog.twitter.com/.…
@nycsouthpaw Southpaw on x
Want to thread in this update for anyone who hasn't seen it. None of “these 8 accounts” (formerly known as “up to 8 accounts") where twitter has ascertained data losses are verified, so Obama and Biden for example are not possibly included in those 8. https://twitter.com/... http…
@harrymccracken Harry McCracken on x
I wonder if Joe Biden, or anyone with access to his account, actually uses it to DM. https://www.theverge.com/...
@alexhern Alex Hern on x
This is an absolutely hilarious response. “We won't tell you who it is, but it's not... you know ;)” https://twitter.com/...
@pakman David Pakman on x
Twitter can protect itself and its users from its own managerial failings by enabling long-promised end-to-end encryption for DMs. https://www.eff.org/...
@kateconger Kate Conger on x
Here's what we know: Someone going by the name Kirk got access to Twitter's internal dashboard. He claimed to be a Twitter employee, but later claimed he hacked into Twitter's Slack channel and found login credentials pinned there.
@tomwarren Tom Warren on x
the Twitter hacker reportedly got access to Twitter's admin panel by finding login credentials pinned inside a Twitter Slack channel. If that's true then holy shit. https://www.nytimes.com/... https://twitter.com/...
@elliptic @elliptic on x
*BREAKING NEWS* - Elliptic Identifies Likely Use of Wasabi Wallet Service to Launder #TwitterHack Bitcoins For more information visit our blog ➡️ https://www.elliptic.co/... #followthemoney #ellipticaml #crypto #cryptoscam #twitter #bitcoin
@uuallan @uuallan on x
New business idea: @SlackHQ Honey Channels. Create new slack channels that should only attract intruders (e.g. #adminpasswords). Automatically lockout any account that joins and trigger an IR investigation. @Lerg & @Maliciouslink I will take all the money now. https://twitter.com…
@6102bitcoin @6102bitcoin on x
I expect the hackers will make a mistake as Wasabi has no postmix spending tools. Probably get caught and go to jail. (Won't be the first time someone gets caught as a result of using a 🍌 mix) https://twitter.com/...
@amitranjan Amit Ranjan on x
Fascinating read - This NYT post on the Twitter hack explains “OG usernames”, the social media username equivalent of domain squatting! Q: “OG usernames usually a short word/number (eg @y @6) are hotly desired, snapped up by early adoptrs to resell later” https://www.nytimes.com/…
@starfire2258 Sean Hollister on x
This is incredible reporting. To think that we know so much, so soon. And yet... not the identity of the hacker who actually did it, or how they got in. Not yet. https://twitter.com/...
@alex_roddie Alex Roddie on x
If true, this is quite a story. It's a tale of opportunistic and mediocre hackers (hardly criminal masterminds) who got lucky and took advantage of Twitter's incompetent security. There's a lesson here for us all. https://twitter.com/...
@mrcheeze_ @mrcheeze_ on x
How much of the online world is just fundamentally insecure? Occasionally a hobbyist does something visible like this and we hear about it, but it is frighteningly easy for state actors to do less visible things. https://twitter.com/...
@ericajoy Erica Joy on x
1) who is sharing creds in SLACK?! i cannot. i was giving twitter a lot of leeway, the pwn comes for us all in the end, but this? this is too much. 2) why did “kirk” appear for this hack then disappear right after? (who is he?) 3) how did “kirk” get access to the twitter slack? h…
@kahjahkins Kahlief Adams on x
If true, i'm not sure why that is surprising. Anyone who's ever worked in IT know that all of our system for the most part are still run by humans. Humans do stuff like this ALL THE TIME lol https://twitter.com/...
@karaswisher Kara Swisher on x
Btw this is a great thread if you want to learn a thing or two about security. In this case, bad security 👇 https://twitter.com/...
@kateconger Kate Conger on x
Hackers involved in the Twitter breach said it started as a quest for cool usernames. Then one member of the group began going after cryptocurrency companies, Jeff Bezos, and Kanye West. w/@nathanielpopper https://www.nytimes.com/...
@iblametom Thomas Brewster on x
Nice scoop - even if it isn't the most exciting narrative behind such a huge hack. If you're at Twitter security this has to be galling that kids/young adults chatting shit with each other on Discord caused such a huge event. https://twitter.com/...
@kateconger Kate Conger on x
When he woke up, Kirk was gone. He'd made off with about $180,000 in bitcoin. Here's our updated story with all the details: https://www.nytimes.com/...
@chuckrossdc Chuck Ross on x
Slack is a bigger security threat for organizations than anything https://www.nytimes.com/... https://twitter.com/...
@modestproposal1 Modest Proposal on x
Real talk: if you gain control of the most important accounts in the world and only make $113K you should be arrested for being the most incompetent crook of all time. “Here's the key to bank vault. Take whatever” “No thanks, give us those pens, the coffeemate and 3 notepads” htt…
@firstadopter Tae Kim on x
Twitter: “We detected what we believe to be a coordinated social engineering attack.” NYTimes: “done by a group of young people — one of whom says he lives at home with his mother ... 19 and lived in the south of England with his mother.” https://www.nytimes.com/...
@ericgeller Eric Geller on x
Wow. Just seeing this. Twitter says it believes the hackers breached all those high-profile accounts by tricking company employees into handing over their passwords. An embarrassing revelation that raises questions about how highly privileged employees protect their accounts. htt…
@anthony Anthony DeRosa on x
Good technical analysis of the Twitter hack: It seems that attackers were able to use the portal access to update the email address on file for the account, revoke any 2FA settings, and then do a password reset to gain access to the account. https://medium.com/...
@somebadideas Aaron Stewart-Ahn on x
In this version it really does look like one of the hacks of the century was by a bunch of bros who wasted it all on clout & bitcoin https://twitter.com/...
@mikefarb1 MikeFarb on x
Exactly. Far greater chance Bitcoin was the cover. If they were able to post on multiple accounts timelines they were in the account. DM's sitting right there. https://twitter.com/...
@racheltobac Rachel Tobac on x
Really interested to learn more in the weeds details of how attackers gained access to Twitter's admin panel. Here a hacker claimed they worked for Twitter but later switched their story and said they hacked into Twitter's Slack to get the creds and admin panel access. We'll see!…
@karissabe Karissa Bell on x
Twitter keeping login credentials for this pinned to a slack channel is .. almost worse than the rogue employee scenario? Why would they not *at the very least* use a password manager?! https://twitter.com/...
@davidclinchnews David Clinch on x
First rule of sourcing information from anonymous self-proclaimed hackers: don't believe a word anonymous self-proclaimed hackers tell you...without receipts-Kate has the receipts still need to take some of what “Kirk” purportedly said about how he gained access with bags of salt…
@histoftech Mar Hicks on x
ok so twitter did the 2020 equivalent of leaving a post-it note on the monitor cool cool cool https://twitter.com/...
@alexstamos Alex Stamos on x
If true, this is no bueno. Enterprises usually have three sources of authentication for employees/contractors: 1) Credentials 2) MFA token (hard or soft) 3) A provisioned corporate device You should have all three to access user data or account controls, not just #1. https://twit…
@yburyug @yburyug on x
on why they went crypto scam and not diplomatic market manipulation via compromised accounts, it's cuz it was a young kid whose like 20 and another bored older script kiddy and pry just lacked the cleverness & were dumb enough to talk to the times about it https://www.nytimes.com…
@tomrobin Tom Robinson on x
The #TwitterHack bitcoins have just started to move again - some being sent to ChipMixer Simultaneous movement of funds from two wallets that have received the hacker's bitcoins suggests they're still under the control of one person @elliptic #twitterscam #twitterhacked
@davidjoachim David S. Joachim on x
Twitter hack: “4 people at the center of the scheme spoke with The Times and shared numerous logs and screen shots of the conversations they had on Tuesday and Wednesday, demonstrating their involvement both before and after the hack became public https://www.nytimes.com/... http…
@juliacarriew Julia Carrie Wong on x
i don't usually cover cybersecurity and everything about this story is freaking me out would really really really love to see twitter get cracking on e2ee for dms and slack get moving on it too https://www.nytimes.com/...
@sanjaykalra @sanjaykalra on x
This #cyberattack is most disturbing not because it was sophisticated or well coordinated by powerful actors, but the opposite - cheaply done by amateurs. Wake up call for all Internet companies to improve defenses-technologically, people & process-wise. https://www.nytimes.com/.…
@dave1agar Dave Agar on x
“it was done by a group of young people — one of whom says he lives at home with his mother — who got to know one another because of their obsession with owning early or unusual screen names, particularly one letter or number” https://www.nytimes.com/...
@fbihop Matthew Reichbach on x
Started as “hey, we should take over and sell these one-character name accounts” and ended up with “let's scam bitcoin by using accounts of celebrities and other powerful people!”
@quantian1 Quantian on x
@modestproposal1 I am skeptical about this. There's almost certainly nothing of value in the DMs for blackmail, and if you tried to do a public stock pump the SEC could investigate/stop wires. Maybe you could try and mess with FX and use some shady Caymans broker and lots of leve…
@golovashkina Anastasia Golovashkina on x
Remember LulzSec in 2011? Reminds me of that. https://www.nytimes.com/...
@ampressman Aaron Pressman on x
Kids say the damnedest things - Instead, it was done by a group of young people — one of whom says he lives at home with his mother — who got to know one another because of their obsession with owning early or unusual screen names, particularly one letter or number, like @y or @6
@sdkstl Staci D Kramer on x
>>The hacker who received the message, using the screen name “lol,” decided over the next 24 hours that Kirk did not actually work for Twitter because he was too willing to damage the company.<< https://www.nytimes.com/...
@tomwarren Tom Warren on x
I love that the New York Times interviewed someone named “lol” and another called “ever so anxious,” on Discord, about the Twitter hack https://www.nytimes.com/...
@haseeb Haseeb Awan on x
Here is what happened as per my info. Hacker met a twitter employee on discord gaming channel and befriended him who sold him his login for 2000. Hacker then replaced emails through this tool & removed 2FA. Rest you guys know ! https://twitter.com/...
@scottmstedman Scott Stedman on x
We live in the dumbest timeline. “the attack was not the work of a nation-state or a sophisticated group of hackers. Instead, it was done by a group of young people — one of whom says he lives at home with his mother” https://www.nytimes.com/...
@jacobrubashkin Jacob Rubashkin on x
The Times talked to four people they say were behind the Great Twitter Hack of July 2020: a bunch of 20-somethings who planned the attack on Discord and then got nervous when one person went rogue and took over high-profile accounts. https://www.nytimes.com/...
@brendandburns @brendandburns on x
“Mr. O'Connor said other hackers had informed him that Kirk got access to the Twitter credentials when he found a way into Twitter's internal Slack messaging channel and saw them posted there” Production creds in Slack is a scary (but very real) thing https://www.nytimes.com/...
@spyblog @spyblog on x
Is #STFU no longer part of #hacker #OPSEC ?? Keeping chat log files & talking to the press = prosecution & extradition, if they are lucky. Worse if they accessed sensitive DMs of billionaires “Hackers Tell the Story of the Twitter Attack From the Inside” https://www.nytimes.com/.…
@rdrv3 @rdrv3 on x
Don't know if I buy Twitter's account of this being social engineering. Did a contractor or someone's kid get access to something they shouldn't have? I am starting to think this will be revealed as far more embarrassing for Twitter than anyone could have originally imagined.
@kateconger Kate Conger on x
Funnily enough, some of his middlemen claimed to be asleep when all this action was taking place! One of them provided screenshots of texts with his girlfriend, saying he was going to take a nap, to corroborate his story.
@martinsfp Martin Sfp Bryant on x
“The [Twitter hack] was done by a group of young people — one of whom says he lives at home with his mother — who got to know one another because of their obsession with owning early or unusual screen names” https://www.nytimes.com/...
@zackwhittaker Zack Whittaker on x
Can confirm much of this @kateconger and @nathanielpopper scoop, which adds more on the Twitter account hacks. Lines up with what I've been told by one well-placed source. https://www.nytimes.com/...
@tomgara Tom Gara on x
Huge validation here for the they're-mostly-just-idiots theory of history https://www.nytimes.com/... https://twitter.com/... https://twitter.com/...
@scottmelker @scottmelker on x
I told you guys @haseeb was a genius. He figured out the entire hack and delivered the hackers directly to the New York Times. https://www.nytimes.com/...
@eamonjavers Eamon Javers on x
The critical failure in the most damaging attacks against the United States has been of imagination. In '01 and '16, we didn't anticipate that airplanes could be suicide missiles, or Facebook posts could manipulate democracy. These were zero-day attacks of social engineering. htt…
@ericgeller Eric Geller on x
Every answer raises more questions. What does “in some way” mean? Were some accounts used for things other than tweeting the Bitcoin scam? I foresee more stern lawmaker letters. https://twitter.com/...
@ericgeller Eric Geller on x
Per NYT, Twitter still doesn't actually know if the hackers got an employee's credentials by socially engineering them (as Twitter initially said) or bribing them (as @josephfcox later reported). https://www.nytimes.com/... https://twitter.com/...

Chronicles