Mega (data) breaches are a major public problem, even though the public may not be too interested in the subject. If you’re a user of popular social media such as LinkedIn, Myspace, Tumblr, and dating websites like BeautifulPeople, you shouldn’t ignore news about data leaks.
We wrote about a malicious email (phishing) campaign triggered by the LinkedIn breach just yesterday. It appears that things are quickly evolving, as cyber criminals are taking advantage of leaked user credentials every day.
Hacker Selling Millions of Twitter Accounts
A hacker going by the name Tessa88, who apparently is involved with the recent mega breaches (mentioned above) is claiming to have obtained a Twitter database consisting of millions of accounts.
The hacker made those claims in an encrypted conversation, and said that the database has email addresses (in some cases two per user), usernames, and plain-text passwords. Tessa88 is selling the database for 10 Bitcoins, or approximately $5,820.
When Were the Twitter Accounts Obtained?
According to Tessa8, the number of harvested accounts is 379 million, and they were obtained in 2015. That would be far more than Twitter’s 310 million monthly active users, but could account for cumulative accounts, such as inactive users, ZDNet explains.
More on Recent Mega Breaches:
LeakedSource received the database from the hacker, and has already analyzed it. After duplicates were removed, 32 million accounts remained.
However, LeakedSource believe that the leak of accounts is not because of a data breach but due to malware. This is what they said in a blog post:
The explanation for this is that tens of millions of people have become infected by malware, and the malware sent every saved username and password from browsers like Chrome and Firefox back to the hackers from all websites including Twitter.
ZDNet author Zack Whittaker writes that:
The group said it was able to verify the passwords associated with 15 users. LeakedSource shared a portion of the database with me. Two colleagues whose email addresses were in the database were able to verify their password. A third colleague said they had not used the email address found in the database to join Twitter.
Furthermore, LeakedSource believes that the passwords were likely “stolen directly from consumers, therefore they are in plaintext with no encryption or hashing.” In addition, it’s highly unlikely that Twitter stored data in plain-text.
Interestingly, Zuckerberg’s Twitter account who recently was hacked, was not in the database.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: