Twitter API Abuse Leads to Exposure of 211 M User Records
What Happened — In early 2023, more than 211 million Twitter records appeared on a hacking forum. The data set was assembled after an attacker abused an undocumented API endpoint that allowed email addresses to be resolved to public Twitter profiles, harvesting email, name, username and follower count information.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient API access controls—a control area that continuous‑monitoring programs must validate and evidence.
- Highlights the need for defensible audit trails showing who accessed which API functions and when.
- Directly tests the organization’s ability to enforce least‑privilege principles for external developers.
Who Is Affected – Social‑media platforms, SaaS providers exposing public‑facing APIs, and any organization that integrates with such services.
Recommended Actions – Review and harden API authentication and authorization policies; implement granular logging of API calls and retain logs for audit; conduct a gap analysis against the “access control” control objective and collect evidence for readiness assessments. Source: Have I Been Pwned – Twitter breach
Technical Notes – The abuse leveraged an undocumented endpoint that did not enforce rate‑limiting or proper credential checks, allowing bulk resolution of email addresses to profile data. No CVE was assigned; the issue is a misconfiguration of API access controls. Source: same as above