Twitter Account Data Leaked on Dark Web: Beware of Identity Theft and Phishing Scams

According to reports by Bloomberg, over 230 million Twitter user email addresses were exposed online due to vulnerabilities in earlier platform code. While Twitter issued statements downplaying evidence of direct internal system compromises, massive databases linking email addresses to user accounts have circulated across underground dark web forums.

This massive trove of leaked credentials leaves countless users vulnerable to targeted credential stuffing, impersonation, and sophisticated phishing scams.

In Japan, the National center of Incident readiness and Strategy for Cybersecurity (NISC) revealed on January 21 that official email addresses used by senior government officials—including personnel across the Ministry of Health, Labour and Welfare, Ministry of Internal Affairs and Communications, Fire and Disaster Management Agency, and National Tax Agency—were found among the exposed datasets on dark web forums.

NISC noted that while the leaked emails were administrative addresses registered with parliamentary services for external social media management and did not contain state secrets, malicious actors could readily leverage them to launch spear-phishing campaigns, harvest sensitive corporate credentials, or distribute trojan malware.

NISC warned: “Targeted cyber attacks may increase substantially; relevant personnel must exercise extreme vigilance.”

Every Twitter user should take this breach seriously and adopt defensive privacy measures:

1. Change Passwords Immediately: Update your credentials and eliminate password reuse across services.
2. Enable Two-Factor Authentication (2FA): Strongly consider hardware security keys or authenticator apps (like TOTP) rather than vulnerable SMS verification.
3. Beware of Suspicious Messages: Scammers routinely craft fake urgent alerts claiming your account is locked. Never click untrusted links or input credentials on unverified third-party pages.