Twitter Discloses Suspected State-Sponsored Attack After Minor Data Breach

In a blog post published^[1]
on Monday, Twitter revealed that while investigating a
vulnerability affecting one of its support forms, the company
discovered evidence of the bug being misused to access and steal
users’ exposed information.

The impacted support form in question was used by account
holders to contact Twitter about issues with their account.

Discovered in mid-November, the support form API bug exposed
considerably less personal information, including the country code
of users’ phone numbers associated with their Twitter account, and
“whether or not their account had been locked.”

So far the company has declined to provide more details about the
incident or an estimate for the number of accounts potentially
impacted but says it believes that the attack may have ties to
state-sponsored actors.

Twitter says that the social networking site addressed the issue
within just one day on November 16 and that there is no action
required from the users’ side.

When the company became aware of the incident, it started
investigating the origins and background of the breach to “provide
you with as much information as possible,” and also updated law
enforcement.

Twitter has started directly notifying the users who, according to
the company, have been impacted by the incident.

In May, Twitter urged all of its 330 million users
to change their passwords^[2]
after a software glitch unintentionally exposed its users’ account
passwords by storing them in plain text on an internal log.

In September, a flaw in Twitter’s
Account Activity API^[3]
exposed some of its users’ direct messages (DMs) and protected
tweets to unauthorized, third-party app developers who weren’t
supposed to get them.

Over the weekend, Twitter was also hit by another software
glitch^[4] that allowed unapproved
third-party apps to access and read users’ direct messages (DMs),
even when they told users that they would not.