July 19 (UPI) — Twitter announced that a total of 130 accounts were targeted in this week’s hack, and that hackers stole personal data — including private messages — from up to eight of the targeted accounts.
In a blog post late Friday, Twitter said hackers used a tool that can download message archives to access eight accounts.
None of those eight users was verified, meaning that so far as Twitter is aware, the highest-profile users whose accounts were compromised Wednesday have not had private messages stolen.
“The most important question for people who use Twitter is likely — did the attackers see any of my private information?” said the company’s post. “For the vast majority of people, we believe the answer is, no.”
But it’s unclear whether those users’ messages were accessed in other ways.
And the company noted that hackers were able to view email addresses, phone numbers and additional information.
The hack compromised accounts belonging to a variety of high-profile individuals, including presumptive Democratic presidential nominee Joe Biden and Tesla CEO Elon Musk — 130 in all, 45 of which were breached.
Those targeted in the hack, which promoted a Bitcoin scam, included several Twitter employees.
“The attackers successfully manipulated a small number of employees and used their credentials to access Twitter’s internal systems, including getting through our two-factor protections,” the blog post said. “As of now, we know that they accessed tools only available to our internal support teams to target 130 Twitter accounts. For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets.”
After the attack, Twitter removed the fraudulent posts and temporarily blocked verified accounts from tweeting or resetting their passwords.
The blog post also said Twitter is still working on restoring access for account owners who may still be locked out and is continuing to investigate the incident.
The company also said it is working on securing its systems to prevent future attacks, and is rolling out “additional company-wide training to guard against social engineering tactics to supplement the training employees receive during onboarding and ongoing phishing exercises throughout the year.”
