The hackers who breached Twitter security — taking over the accounts of Apple, Barack Obama, Bill Gates, Elon Musk and others to promote a cryptocurrency scam — also raided the inboxes of 36 of their targets, Twitter has confirmed.
“We’re embarrassed, we’re disappointed, and more than anything, we’re sorry”, the social media company said, confirming that the attack came after “a small number of employees” were phished and their credentials used to access Twitter’s internal systems, “including getting through our two-factor protections.”
“As of now, we know that they accessed tools only available to our internal support teams to target 130 Twitter accounts. For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets. We are continuing our forensic review of all of the accounts to confirm all actions that may have been taken”, Twitter support said in a blog updated on July 22.
“In addition, we believe they may have attempted to sell some of the usernames.”
For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Data” tool, Twitter said. This is a tool that is meant to provide an account owner with a summary of their Twitter account details and activity. “We are reaching out directly to any account owner where we know this to be true. None of the eight were verified accounts.”
Among the eight, arguably curiously, was an “elected Dutch official”.
Twitter is “rolling out additional company-wide training to guard against social engineering tactics to supplement the training employees receive during onboarding and ongoing phishing exercises throughout the year” the company said.
Investors appear blase about the attack and the reputational impact on Twitter. The company’s share price barely wobbled and has since climbed again. Twitter reported revenues of $808 million in Q1, 2020. The company claims 166 million “monetizable” daily active users. In April it noted that “we have shifted resources and priorities to increase focus on our revenue products, particularly performance ads beginning with
MAP, with the goal of accelerating our long-term roadmap.”
