Hacker ``Ryushi'' demands $ 200,000 in exchange for deleting personal information of more than 400 million Twitter accounts, self-defense method is this



It turned out that a hacker named Ryushi is trying to sell 400 million user data that is said to have been stolen by exploiting Twitter's vulnerability. Ryushi is urging Twitter and Elon Musk to purchase data, demanding 'buy it immediately before you get a large fine from the EU's General Data Protection Regulation (GDPR).'

Hacker claims to be selling Twitter data of 400 million users
https://www.bleepingcomputer.com/news/security/hacker-claims-to-be-selling-twitter-data-of-400-million-users/

According to Ryushi's statement posted on the hacker forum, Ryushi stole 400 million user data from Twitter, including non-public information such as email addresses, names, and phone numbers. Ryushi urges Twitter and Twitter's Elon Mask CEO to purchase data for $ 200,000 (about 26 million yen), and claims that if purchased, the data will be deleted. If Twitter does not respond to this, it will sell copies to multiple people for $ 60,000 (about 8 million yen) per time.

Ryushi cited anincident in which data of 533 million people was leaked from Facebook before, saying, 'The best way to avoid the $ 276 million (about 38 billion yen) ( paid by Facebook as a fine for violating the GDPR) is The way is to buy this data exclusively,' he threatened. Ryushi also publishes sample data for 1,000 people, including Congressman Alexandria Ocasio-Cortez and Donald Trump Jr.




Aaron Gall, CTO of research firm Hudson Rock, said: 'It's becoming more and more likely that the data is genuine. This data is likely revealing vulnerabilities in APIs that allow hackers to query emails and phone numbers to retrieve Twitter profiles. It was acquired by poke, and it is extremely similar to the incident in which 533 million user data was leaked from Facebook.'

According to BleepingComputer, which has obtained detailed information from Ryushi, Ryushi used an API vulnerability that previously caused the leak of user data for 5.4 million people on Twitter to obtain information. This was fixed by Twitter in January 2022, but Ryushi seems to have tried the same method before the fix.

In addition, the Irish Data Protection Commission (DPC), which was also in charge of the Facebook investigation, has begun investigating the circumstances of the data leak from December 23, 2022.

The news site MakeUseOf lists the following as self-defense measures associated with data leakage.

・If you are using the email address registered with Twitter for another service, change it immediately.
・Change the phone number as well.
・Use the alias of your email address for all services you subscribe to in the future.
Use backup phone numbers when possible
・Use app-based two-factor authentication

Related Posts:

in Web Service,   Security, Posted by log1p_kr