Disclosed Dec 15, 20205 years agoSettled
Protected tweets bug notified late; Irish DPC fine of EUR 450,000
A bug made protected Twitter for Android accounts public when users changed their email address. Ireland's DPC, investigating after Twitter's 8 January 2019 breach notification, found it notified late and failed to document the breach properly, and fined it EUR 450,000 in its first cross-border GDPR decision.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Dec 15, 2020 |
| Discovered | Jan 3, 2019 |
| Attack | Exposed data |
| Data exposed | Messages |
| Sector | Tech · US |
| Status | Settled |
| Lawsuit or fine | EUR 450,000 Irish DPC fine (Dec 2020) (about $547K) |
Sources
| Source | |
|---|---|
| Twitter fined ~$550K over a data breach in Ireland's first major GDPR decisiontechcrunch.com · News | News |
| Confirmation of Fine: Twitter International Companydataprotection.ie · Regulator | Regulator |
| DPC announces decision in Twitter inquirydataprotection.ie · Regulator | Regulator |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Dec 15, 2020 |
Other breaches at Twitter
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Scraped emails and profiles of over 200 million Twitter users posted onlineJan 5, 20233 years agoScrapingUnverified | Jan 5, 20233 years ago | Scraping | Tech | Unverified | 212Macct |
| API flaw let attacker link emails and phone numbers to Twitter accountsAug 5, 20224 years agoHacking | Aug 5, 20224 years ago | Hacking | Media | Confirmed | 6.7Macct |
| Phone spear phishing gives attackers internal tools, 130 accounts targetedJul 15, 20206 years agoPhishing | Jul 15, 20206 years ago | Phishing | Tech | Confirmed | 130 |
| Hackers gained admin control of Twitter twice in 2009; FTC security orderJun 24, 201016 years agoHacking | Jun 24, 201016 years ago | Hacking | Tech | Settled | Unknown |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.