2023-10-04

Social network data breach

I just checked my email on Have I Been Pwned to see if any new data breaches involving my data would come up.

Something new indeed came up.

Twitter (200M): In early 2023, over 200M records scraped from Twitter appeared on a popular hacking forum. The data was obtained sometime in 2021 by abusing an API that enabled email addresses to be resolved to Twitter profiles. The subsequent results were then composed into a corpus of data containing email addresses alongside public Twitter profile information including names, usernames and follower counts.

Compromised data: Email addresses, Names, Social media profiles, Usernames

Wait a second. Is this considered a data breach? Twitter profiles are there for the public to see. Email addresses are not shown in public by default. So resolved email addresses to their respective profiles could be a data breach. But emails are not that private anyway.

If the catalogued social network profile information is used in a phishing scam or social hacking, it would be detrimental to inevitable portion of public mass. But it's not clear how you can prevent this.

Your data on social network platforms are not yours. Needless to say data on your profile pages.