Twitter says hackers downloaded account info, which may include DMs, of up to 8 accounts via its “Your Twitter Data” tool, but none of the 8 were verified users
Sean Hollister / The Verge :
Context & Ripple Effects
The picture around last Wednesday's attack keeps widening. Two days after Twitter said 130 accounts were hit and a small subset was used to send tweets (130 accounts affected), and while it locked accounts that had reset passwords as a precaution, the company now discloses a quieter second channel: hackers used the 'Your Twitter Data' export tool itself to download information — possibly including DMs — from up to eight accounts, none of them verified.
That detail matters because it shows the intruders worked through a legitimate user-facing feature, not just compromised credentials. Days later, Twitter confirmed the damage ran deeper still, with DM inboxes exposed for up to 36 of the 130 targeted accounts (DM inboxes accessed) — an arc that foreshadowed how Twitter's data-exposure problems outlived the incident itself, resurfacing years later in leaked datasets of 200M+ user email addresses.
First-order effects
- Up to eight non-verified account holders now know their exported data — potentially including private messages — left Twitter's systems in attackers' hands, expanding the blast radius beyond the famous verified targets.
Second-order effects
- Disclosure of the 'Your Twitter Data' pathway forces Twitter to treat its own user-facing export tools as an attack surface, inviting scrutiny of every feature that packages private data for download.
Third-order effects
- If the pattern holds — from this breach's tool-based exfiltration to later large-scale leaks of scraped Twitter data — platform data archives shift from per-incident liabilities to persistent assets that attackers harvest and re-leak over years.
The trend: Platform breaches are giving way to durable, re-circulating datasets: once private user data leaves a social network via tools or scrapes, it resurfaces in leaks for years afterward.