Description: Twitter suffered a data breach incident after a threat actor compiled a list of 5.4 million user account profiles by exploiting a now-patched zero-day vulnerability that was used to link email addresses and phone numbers to users' accounts. This vulnerability allowed anyone to submit an email address or phone number, verify if it was associated with a Twitter account, and retrieve the related account ID. The threat actor verified phone number or email address, and scraped public information, such as follower counts, screen name, login name, location, profile picture URL, and other information, and sold the data for $30,000.

Description: A seller has apparently listed data realted to 400 million Twitter users for sale. The data, that were allegedly scraped due to a vulnerability, included email, name, username, follower_count, creation_date, and phone_number. The seller demanded $276 million USD in GDPR breach fines from Twitter to buy the stolen data exclusively.

Description: The attack had been described as the biggest hack in the social media platform’s history. It compromised 130 Twitter accounts, including 45 that send a tweet claiming that anyone who transferred money to a linked Bitcoin address could double their investment. The Twitter accounts of several high-profile figures, including Microsoft’s co-founder Bill Gates and Tesla CEO Elon Musk, were hacked in a Bitcoin scam. The scammers behind the operation tricked 398 people into handing over more than £109,000 in bitcoins. Twitter described the incident as a coordinated social engineering attack against employees with access to its internal tools.

Description: A data breach allegedly perpetrated by a disgruntile employee during a period of mass layoffs at Twitter may have resulted in the leakage of profile metadata from up to 2.87 billion users. While the breach does not contain email addresses, the merged dataset from the 2025 leak combined with a previous 2023 leak does, enabling potential phishing attacks and privacy violations. The lack of an official response from Twitter raises concerns about the extent of compromised user data and corporate accountability.

Description: A massive breach involving an ex-employee leaked detailed user profile data from roughly 2.87 billion Twitter accounts, combining new and previously exposed information. The dataset includes user metadata like IDs, screen names, follower counts, and tweets, increasing risks of phishing and impersonation. Although no sensitive information such as email addresses was found in the new data, the merge with past breaches presents a comprehensive user profile view. Twitter has not acknowledged the breach, which stands as the second-largest in history.

Description: Twitter was targeted by a cyber attack in July 2022. Influencers, celebrities, politicians, journalists, activists,government and private organizations was the prime target. Hackers hacked the Verified Twitter accounts to send fake suspension notices.

Description: On Monday, Twitter experienced multiple worldwide outages attributed to DDoS attacks by the Dark Storm hacktivist group. While not explicitly confirmed by owner Elon Musk, it is suggested that Twitter was the target of a 'massive cyberattack', likely due to political motivations by the pro-Palestinian group. Users were presented with a Cloudflare captcha due to the DDoS protections put in place. This incident caused significant disruption to Twitter's services, impacting users globally. The financial implications and potential loss of user trust could harm Twitter's reputation, albeit temporarily.

Description: The sophisticated RapperBot botnet campaign targeted digital video recorders (DVRs) worldwide, exploiting vulnerable IoT devices to execute large-scale DDoS attacks. The campaign, a variant of the Mirai malware, compromised DVR systems to gain unauthorized access to surveillance cameras, leading to significant privacy and security issues. The attack on X (formerly Twitter) on March 10, 2025, caused a service disruption, demonstrating the malware's persistence and evolution over three years. The attackers exploited weak default passwords and infrequent firmware updates in DVRs, making them ideal for long-term botnet recruitment. The campaign's reach was amplified by targeting DVRs manufactured by Korean OEM ITX Security, distributed across multiple brands.

Description: Twitter suffered a data breach incident, vine users of a bug that exposed their email addresses and, in some cases, phone numbers to third parties. In addition, it warns impacted users to be wary of any communications coming from unfamiliar senders. Twitter asked users to do not need to reset passwords on their Vine accounts, but should be aware that any official communications from Vine will come from an @twitter.com email address. Twitter never ask you via email to open an attachment or request your password.

Description: Twitter experienced another security incident. The business users’ billing information was inadvertently stored in the browser’s cache, and others, those who share computers, could have accessed it. That data includes the business users’ email addresses, phone numbers, and the last four digits of their credit card numbers associated with the account.

Description: Twitter gave an update on the investigation it initiated after discovering that the personal information of 200 million users was being sold online. There is no proof that the data were obtained through breaking into the company's systems. Since the 200 million dataset was not collected by abusing Twitter's servers, it was unable to be correlated with the previously disclosed incident. The business emphasised that the vast amount of data is probably a component of a publicly accessible dataset that comes from various sources. Based on data and intelligence analysed to look into the matter, there is no proof that the information being sold online was obtained through abusing a flaw in Twitter's infrastructure.

Description: Twitter has advised all of its 330 million+ users to update their passwords following the discovery of a fault that left them in plain text on internal servers. The number of impacted accounts was not disclosed by the company, but Reuters was informed by a source familiar with the company's response that it was a sizable number. According to the corporation, over 330 million people have been affected, and just one internal system had plain text data kept on it. Twitter declared that the security flaw had been resolved and that an internal inquiry had been launched to determine whether insiders had misused user data.

Description: A bug in Twitter about how it handles password reminders allowed users to take control of other accounts such as @emoji and @god. Usually if a user went to reset a password, it would partially asterisking the mail out, however this time it displayed the full email address tied to it. This allowed hackers to hijack many accounts and tweet on their behalf, but majority of accounts that were soon taken over were restored to normal.

Description: Twitter experienced a new security vulnerability that exposed the direct messages of users who access the service using Android devices. The vulnerability exposed the private data of Twitter users running devices with Android OS versions 8 and 9. This vulnerability could allow an attacker, through a malicious app installed on device, to access private Twitter data on people's device by working around Android system permissions that protect against this.

Description: In July 2020, Twitter experienced a significant security breach that spanned several phases, including social engineering to gain network access, account takeover for valuable 'OG' usernames, and a high-profile bitcoin scam involving verified accounts of well-known individuals and companies. Hackers utilized sophisticated methods such as phishing to capture Twitter employees' credentials, exploiting the system to access internal tools. The incident led to the compromise of 130 user accounts, with hackers targeting and manipulating high-profile accounts to promote a bitcoin scam, fraudulently acquiring about $118,000. The breach not only exposed users' nonpublic information but also put a spotlight on potential vulnerabilities within Twitter's security frameworks, bringing into question the platform's capacity to safeguard user data and resist manipulative external threats.