The user data for more than 2.8 billion X (formerly Twitter) accounts has been leaked in what an anonymous user on the site alleges was an inside job by a disgruntled employee, who stole the data during a period of mass layoffs.
A user named ThinkingOne claims more than 400GB of data was taken during the mass firing period at X last year, during which Musk told BBC he had laid off 80% of the company’s employees.
The anonymous user claims they attempted to contact X through several channels and received no response, subsequently merging the leaked data with another large breach from 2023 and publishing it themselves.
What kind of data was leaked?
In 2023, X was rocked by a data leak that revealed user email addresses, display names and usernames, follower counts and account creation dates, with security experts warning large-scale phishing and identify theft could be the result.
This latest leak is even more expansive. Aside from account creation dates, user names, follower counts and profile descriptions, it also included location and time zone settings, tweet counts and timestamps of the last tweet, friends count, listed count and favourites count, and status settings (whether the profile is verified).
The data offers a detailed peek into X users’ profiles and activities, particularly between 2021 and 2015, but doesn’t include the email address data leaked in 2023.
Many of the accounts probably don’t belong to real users either – X likely has something around 400 million global users, meaning many of the data profiles must originate from old, deactivated accounts, spammers, or bots.
The leak will still have repercussions for those caught up in the 2023 incident, however, as their email addresses are already publicly available and can now be cross-referenced with a plethora of metadata that could enable phishing and social engineering campaigns as well as identify theft attempts.
There has been no official response to the leak from X management as of yet, and certainly no confirmation that ThinkingOne’s claims a disgruntled employee affected the leak are true at present.