In light of Twitter’s recent slew of security incidents, including a former employee spying for the Saudi Arabian government and former security chief Peiter Zatko claiming poor cybersecurity practices, we decided it only natural to review every one of Twitter’s cybersecurity incidents. This article covers 12 scandals reported by Firewall Times that have ever occurred in the platform’s history. This shocking number helps us understand why 81% of 1,000 Americans report feeling more concerned about their social media privacy than last year.

Before Twitter’s current scandals, the social media platform had already experienced 11 major security incidents starting back in 2009, three years after Twitter was born.

2009: 18-year-old Hacks Several Celebrity Accounts

In January of 2009, an 18-year-old hacker managed to access several high-profile accounts. Accounts included former U.S. president Barack Obama and Fox News. According to Wired, the cybercriminal had a history of hacking celebrity accounts prior to this attack. The hacker publicly claimed to have gained access through an automated password-guesser.

2009: Hackers Obtain Administrator Controls of Twitter

In April of 2009, upon gaining access to a Twitter employee’s personal information, a hacker was able to access a Twitter’s administrative account. Soon after, the FTC became aware and sought to charge Twitter, saying their actions were deceitful and that they failed to protect the personal information of Twitter users.

2013: Twitter Compromise of 250,000 Accounts

In February 2013, a breach was discovered after the company detected “unusual access patterns” that led them to find the incident. Upon discovery, Twitter was able to shut down a live attack while in progress. Although not before thousands of Twitter users’ information had already been stolen. This attack was believed to have been carried out by amateurs, and yet it resulted in over 250,000 Twitter users’ names and emails being compromised.

2018: Twitter Glitch Leaves All Users’ Passwords Exposed

In May of 2018, Twitter discovered a glitch that left all of its 330 million users’ passwords exposed within Twitter’s internal system. Rather than being encrypted within their system using symbols and numbers, users’ passwords were written in plain text. Although no evidence of misuse of the information had been found, Twitter still urged all users to change their passwords at the time.

2018: Twitter Leaks Account Phone Number Country Codes

In December 2018, Twitter mistakenly allowed the country codes of user accounts to become discoverable. Concerns over this security flaw included the ramifications for the Twitter accounts of activists, whistleblowers, and anyone else who may be concerned about their political opinions being found by their country.

2019: Users’ Personal Information Used for Twitter Ad Targeting

In October 2019, it was discovered that Twitter had included their users’ phone numbers and emails in their ad targeting efforts without users’ consent. Twitter marketers used the phone numbers and emails to determine which users fit the ad’s target audience. Although Twitter claims this was an accident, it is unknown how long the information was being used unbeknownst to the Twitter users.

2019: Two Former Twitter Employees Spy for Saudi Arabia

In November 2019, two former Twitter employees were found and charged with spying on the United States for Saudi Arabia. The employees were found guilty of gathering private information on specific individuals on behalf of the Saudi Arabian government for upwards of $300,000 USD.

2019: Hundreds of Android Twitter Users’ Info Leaked

In November 2019, a small-scale breach occurred when hundreds of Android Twitter users’ were informed their data had been compromised. Information was accessed when users logged into their accounts through compromised Google Play Store third-party apps.

2020: Hacker Targets 130 High-Profile Accounts

In July 2020, hackers targeted over 130 high-profile users’ accounts, including Bill Gates, Barack Obama, Kim Kardashian, and Elon Musk. After gaining access, the hacker began tweeting via the accounts, stating that they would be “giving back to the community” and that every bitcoin sent to them would be doubled and returned to the sender. The hackers were able to obtain $100,000 USD worth of bitcoin with the scamming tweets.

 2022: “Devil” Hacker Steals 5.4M Twitter Users’ Data

In July 2022, self-titled “devil” hacker posted on the hacking forum, BreachForums, that they had stolen the personal information of 5.4 million Twitter users, as reported by Firewall Times. The hacker later posted the vulnerability used to steal the data online for sale for $30,000 USD.

2022: Former Twitter Employee Spies for Saudi Arabia

In August 2022, another ex-Twitter employee was found guilty of spying for the Saudi Arabian government. The former employee was enlisted to gather information on critics of the Saudi monarchy and report back to a close employee of Crown Prince Mohammed bin Salman. The relationship between the former employee and the Saudi government had been ongoing since 2014.

2022: Ex-Twitter Head of Security Reports Twitter Security Negligence 

In August 2022, the former head of security of Twitter and a well-known hacker in the cybersecurity community– Peiter “Mudge” Zatko, alleged that Twitter deceived the public by misrepresenting how it fights spam and hackers. More specifically, Zatko accused Twitter’s chief executive Parag Agrawal of legal violations and negligence towards the security of Twitter users’ data. Zatko’s claims are speculated to be used in Elon Musk’s attempts to undo his purchase of the company, as Zatko has said Twitter lied to Musk about the platform’s bots.

Protecting Your Account

The first step in keeping our private information safe is controlling the information we choose to put out online for the world’s consumption. The internet is forever, and it is at risk if the information is online. As a society, we have become accustomed to sharing every aspect of our lives online. Even more difficult, nearly every app and website require our personal information, such as our names, emails, and phone numbers. David Emm, a principal security researcher at Kaspersky, stated “…we need to control what we want to make public and what we don’t.” Threat actors increasingly recognize the power of social media platforms and their potential to get them closer to their economic, political, or social gains.

For more information on how to keep your Twitter account secure, check out Twitter’s list of recommendations here.