Twitter

Disclosed Aug 5, 20226,682,453 accountsConfirmed

API flaw let attacker link emails and phone numbers to Twitter accounts

Twitter confirmed that a bug reported in January 2022 let anyone submitting an email or phone number learn the linked account, and that a bad actor exploited it before the fix and offered the data for sale. The seller claimed profiles of 5.4 million accounts; Twitter did not give a count.

What is known

People affected	6,682,453 (accounts in the leaked data, per Have I Been Pwned)
Disclosed	Aug 5, 2022
Discovered	Jan 2022
Happened	Jan 1, 2022
Attack	Hacking
Data exposed	EmailsLocationNamesPhone numbers
Sector	Media · US
Status	Confirmed
Check your email	Have I Been Pwned

Sources

Aggregatorhaveibeenpwned.com

Have I Been Pwned: Twitter

The organizationprivacy.twitter.com

An incident impacting some accounts and private information on Twitter

Newsbleepingcomputer.com

Twitter confirms zero-day used to expose data of 5.4 million accounts

Notices filed

TotalAug 5, 2022

ResearchCount not stated

Accounts in the dataAug 13, 2022

Have I Been Pwned6,682,453 people

Other breaches at Twitter

Scraped emails and profiles of over 200 million Twitter users posted onlineScraping exposed emails and names.Scraping212M accountsTechUSUnverifiedJan 5, 2023 Protected tweets bug notified late; Irish DPC fine of EUR 450,000Exposed data exposed messages.Exposed dataTechUSDec 15, 2020 Phone spear phishing gives attackers internal tools, 130 accounts targetedPhishing exposed messages.Phishing130 affectedTechUSJul 15, 2020 Hackers gained admin control of Twitter twice in 2009; FTC security orderHacking exposed credentials and tokens and messages.HackingTechUSJun 24, 2010

History of this record

source_type2026-09-25

aggregator to companyby seedSource

source_url2026-09-25

https://haveibeenpwned.com/Breach/Twitter to https://privacy.twitter.com/en/blog/2022/an-issue-affecting-some-anonymous-accountsby seedSource

status2026-09-25

disclosed to confirmedby seedSource

verified_by2026-09-25

empty to researchby seedSource

verified2026-09-25

0 to 1by seedSource

country2026-09-25

empty to USby seedSource

sector2026-09-25

tech to mediaby seedSource

attack2026-09-25

unknown to hackingby seedSource

disclosed2026-09-25

2022-08-13 to 2022-08-05by seedSource

discovered2026-09-25

empty to 2022-01by seedSource

summary2026-09-25

In January 2022, a vulnerability in Twitter's platform allowed an attacker to build a database of the email addresses and phone numbers of millions of users of the social platform . In a disclosure notice later shared in August 2022, Twitte to Twitter confirmed that a bug reported in January 2022 let anyone submitting an email or phone number learn the linked account, and that a bad actor exploited it before the fix and offered the data for sale. The seller claimed profiles of 5.by seedSource

title2026-09-25

empty to API flaw let attacker link emails and phone numbers to Twitter accountsby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Have I Been Pwned), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Twitter