Quote:Twitter says that it discovered and fixed an issue exploited by attackers to match specific phone numbers to their corresponding Twitter accounts.
 
"On December 24, 2019 we became aware that someone was using a large network of fake accounts to exploit our API and match usernames to phone numbers," Twitter explains.
 
"We immediately suspended these accounts and are disclosing the details of our investigation to you today because we believe it’s important that you are aware of what happened, and how we fixed it."
 
During the following investigation, the company's security team found additional accounts that might have exploited the same vulnerable API endpoint to get access to accounts' phone numbers.

"It is possible that some of these IP addresses may have ties to state-sponsored actors. We are disclosing this out of an abundance of caution and as a matter of principle. - Twitter"

Although the malicious accounts were located in countries from all around the globe, a large number of requests to the affected API were coming from IP addresses within Iran, Israel, and Malaysia.