Twitter (X) hacks: the big incidents and how to secure your account

The July 2020 bitcoin scam hack

On July 15, 2020, verified accounts belonging to well-known people and companies, including politicians, executives and celebrities, posted messages promising to double any bitcoin sent to an address. Twitter later said the attackers targeted about 130 accounts, tweeted from 45, reached the direct messages of up to 36, and downloaded data from 7.

Twitter said the attackers used a phone spear-phishing attack on a small number of employees to get their credentials and reach internal account-management tools. In other words, they tricked people, not software.

Who was prosecuted

Clark, who was 17 at the time of the hack, was described by prosecutors as its leader. Because he was sentenced as a youthful offender, he avoided a longer adult sentence. O’Connor was also ordered to forfeit about $794,000.

The 2022 API leak of 5.4 million accounts

In January 2022 Twitter received a report through its bug bounty program about a flaw in its API, the interface apps use to talk to Twitter. The flaw let anyone who submitted an email address or phone number find out which Twitter account it belonged to, even if the user had hidden that in their privacy settings. Twitter fixed it, but attackers had already used it.

In July 2022 a dataset of about 5.4 million account profiles built with the flaw was offered for sale on a hacking forum, and later released for free. In December 2022 Twitter confirmed that the leaked data matched the vulnerability it had fixed. The main danger was to pseudonymous accounts, since the leak could link them to a real email address or phone number.

In January 2023 Twitter said a separate, larger set of about 200 million email addresses circulating online could not be linked to a new breach of its systems and appeared to be a collection of data already public.

The FTC case over phone numbers (2022)

In May 2022 the FTC said Twitter had used phone numbers and email addresses that people gave it for account security, such as two-factor login, to target ads. Twitter agreed to pay a $150 million penalty and to stop using that data for ads. It is a useful reminder that a phone number given for security can be used in other ways.

How X accounts get taken over today

• Phishing, including fake "copyright violation," "verification" or "account suspended" messages that lead to a fake login page.
• Reused passwords leaked from other sites.
• SIM swapping, so login codes sent by text go to the attacker.
• Malicious third-party apps you have given access to your account.

How to protect your X account

1. Use a unique password Store it in a password manager.
2. Turn on two-factor authentication with an app or security key Since 2023, X has limited text-message two-factor login to paid subscribers. Authenticator apps and security keys are available to everyone and are safer against SIM swapping.
3. Turn on password reset protection So that resetting your password requires your email address or phone number.
4. Review connected apps and sessions Remove apps you don't use and log out of sessions you don't recognize.
5. Ignore urgent messages about your account Go to the app or site yourself instead of clicking links in emails or DMs.

See also Facebook account security, WhatsApp security and our George Hotz profile, which covers his brief 2022 Twitter internship.