Breachesby GlyphDisclosed Dec 15, 2020Settled
Protected tweets bug notified late; Irish DPC fine of EUR 450,000
A bug made protected Twitter for Android accounts public when users changed their email address. Ireland's DPC, investigating after Twitter's 8 January 2019 breach notification, found it notified late and failed to document the breach properly, and fined it EUR 450,000 in its first cross-border GDPR decision.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Dec 15, 2020 |
| Discovered | Jan 3, 2019 |
| Attack | Exposed data |
| Data exposed | Messages |
| Sector | Tech · US |
| Status | Settled |
| Lawsuit or fine | EUR 450,000 Irish DPC fine (Dec 2020) (about $547K) |
Sources
Notices filed
Other breaches at Twitter
Scraped emails and profiles of over 200 million Twitter users posted onlineScraping exposed emails and names.Scraping212M accountsTechUSUnverifiedJan 5, 2023API flaw let attacker link emails and phone numbers to Twitter accountsHacking exposed emails, location data, names and phone numbers.Hacking6.7M accountsMediaUSAug 5, 2022Phone spear phishing gives attackers internal tools, 130 accounts targetedPhishing exposed messages.Phishing130 affectedTechUSJul 15, 2020Hackers gained admin control of Twitter twice in 2009; FTC security orderHacking exposed credentials and tokens and messages.HackingTechUSJun 24, 2010
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.