New blow for Twitter! A hacker has put the data of 400 million Twitter accounts for sale, including those of celebrities and large companies. He urges Elon Musk to buy them back from him to avoid a very heavy fine.

New blow for Twitter! A hacker has put the data of 400 million Twitter accounts for sale, including those of celebrities and large companies. He urges Elon Musk to buy them back from him to avoid a very heavy fine.

As Elon Musk strives to keep Twitter afloat – a task that is not easy, given his questionable decisions and the flight of advertisers – a new tile falls on him. Indeed, a hacker answering to the pseudonym of Ryushi claims to have seized the data of 400 million accounts – unheard of for the social network, which nevertheless faced a massive hack in August 2022 –, including e- emails and phone numbers of celebrities and big companies. If any doubt remains about the seller’s words, several details that cybersecurity experts have looked into suggest that he is not lying. On a forum, the hacker challenged the new CEO of Twitter to make him an offer and avoid legal trouble, but the latter has not yet commented on the incident.

Twitter hack: Elon Musk is asked to take out the checkbook

On the Dark Web, the hacker provided a sample of 1,000 accounts so that a potential buyer could verify the authenticity of the stolen data, as reported Security Affairs. Among them are those of the American Democrat Alexandria Ocasio-Cortez, the CEO of Google, the businessman Sundar Pichai and several leading figures in the world of cryptocurrencies, such as Vitalik Buterin, one of the creators of the blockchain. Ethereum. It can however be noted that, if the database is indeed real, it must have a good number of inactive accounts, because Twitter does not have 400 million monthly active users.

Before selling his database to the highest bidder, the hacker recommends that Elon Musk, as he is the new boss of Twitter, buy it himself in order to protect the social network and avoid a large fine. Also, he writes in his post: “Twitter or Elon Musk if you’re reading this you currently risk a GDPR fine of over 5.4 million breaches, so imagine a fine for a breach involving 400 million users. Your best bet to avoid paying 276 million of dollars in fines for violating the GDPR like Facebook did (because of 533 million users affected) is to buy this data exclusively”. Indeed, Elon Musk already faces the risk of a fine for leaking the data of 5.4 million accounts in August 2022 – and the consequences of which are more serious than expected. The Irish Data Protection Commission also opened an investigation into Twitter on Friday, for breach of the General Data Protection Regulation (GDPR) in force in Europe since 2018. To negotiate the price, you must contact the pirate by private message or on Telegram.

Twitter: the accounts of 400 million users hacked

Several cybersecurity experts looked into the sample data provided by the hacker to verify its authenticity. This is particularly the case of the intelligence company Hudson Rock. A priori, there would be no link with the attack last August because the sample does not show enough similarities with the data of the 5.4 million accounts. This new leak seems perfectly credible, even if Alon Gal, co-founder and technical director of Hudson Rock does not confirm the figure of 400 million stolen accounts. This is also what DefiYield thinks, a decentralized finance platform, which explains that it has “verified each of the 1,000 accounts given by the hacker”.

The hacker explains that he had access to this data after finding various flaws in the code of the social network, in particular the one used to steal the data between 2021 and 2022. Alon Gal believes that he probably relied on a breach of the API (Application Programming Interface) from Twitter, via the “Allow people who have your phone number to find you on Twitter” function. As a reminder, it was corrected by Twitter engineers in early 2022, but several hackers obviously had time to take advantage of it.