400GB of X (Twitter) Data Allegedly Leaked by Threat Actors on Hackers Forums

The breach was first reported on March 28, 2025, by a user known as “ThinkingOne” on the infamous Breach Forums, who claims the data was stolen by a disgruntled employee during a period of mass layoffs at the company. A massive data leak, potentially the largest social media breach ever, reportedly exposes 400GB of data from roughly 2.87 billion Twitter (X) user accounts. While the 2023 breach contained email addresses, the 2025 leak notably lacks this sensitive information. For X users, the exposure of detailed profile information increases the risks of targeted phishing attacks and identity impersonation, even without email addresses being directly compromised in the latest leak. The breach files appear to be structured in a standardized CSV format, similar to how data could be extracted using API tools like Tweepy. Further investigation by Cyber Press uncovered 165 related files, including multiple compressed CSV files dated January 24, 2025, with sizes ranging from 361MB to 376MB each. If authentic, this incident would represent the second-largest data breach in history, surpassed only by the National Public Data breach of 3.1 billion records. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. “I tried contacting X via several methods with no response,” stated ThinkingOne, explaining their decision to publicly release the information after claiming the company ignored their warnings. According to their investigation, the information appears legitimate, though they could not confirm if all email addresses belong to the associated accounts. A high-severity security vulnerability (CVE-2025-1449) affecting its Verve Asset Manager product could allow attackers with administrative access to execute arbitrary commands.

This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 01 Apr 2025 14:50:03 +0000

Cyber News related to 400GB of X (Twitter) Data Allegedly Leaked by Threat Actors on Hackers Forums

How to perform a proof of concept for automated discovery using Amazon Macie | AWS Security Blog - After reviewing the managed data identifiers provided by Macie and creating the custom data identifiers needed for your POC, it’s time to stage data sets that will help demonstrate the capabilities of these identifiers and better understand how ...
8 months ago Aws.amazon.com

Staying ahead of threat actors in the age of AI - At the same time, it is also important for us to understand how AI can be potentially misused in the hands of threat actors. In collaboration with OpenAI, today we are publishing research on emerging threats in the age of AI, focusing on identified ...
1 year ago Microsoft.com Kimsuky

Hackers email stolen student data to parents of Nevada school district - The Clark County School District in Nevada is dealing with a potentially massive data breach, as hackers email parents their children's' data that was allegedly stolen during a recent cyberattack. CCSD is the fifth largest school district in the US, ...
1 year ago Bleepingcomputer.com

Credentials are Still King: Leaked Credentials, Data Breaches and Dark Web Markets - Infostealers infect computers, steal all of the credentials saved in the browser along with active session cookies and other data, then export it back to command and control infrastructure before, in some cases, self-terminating. This article will ...
1 year ago Bleepingcomputer.com

Cybercriminals are Showing Hesitation to Utilize AI Cyber Attacks - Media reports highlight the sale of LLMs like WormGPT and FraudGPT on underground forums. Fears mount over their potential for creating mutating malware, fueling a craze in the cybercriminal underground. Concerns arise over the dual-use nature of ...
1 year ago Cybersecuritynews.com

400GB of X (Twitter) Data Allegedly Leaked by Threat Actors on Hackers Forums - The breach was first reported on March 28, 2025, by a user known as “ThinkingOne” on the infamous Breach Forums, who claims the data was stolen by a disgruntled employee during a period of mass layoffs at the company. A massive data leak, ...
2 months ago Cybersecuritynews.com CVE-2025-1449

TeamCity Intrusion Saga: APT29 Suspected Among the Attackers Exploiting CVE-2023-42793 - As part of this analysis, we look at threat actor TTPs employed throughout the intrusion and how they were identified and pieced together by the FortiGuard IR team. The following section of this report focuses on the activities of one of these threat ...
1 year ago Feeds.fortinet.com CVE-2023-42793 APT29

Operation Morpheus took down 593 Cobalt Strike servers used by threat actors - Threat actors actively exploit D-Link DIR-859 router flaw CVE-2024-0769. Experts released PoC exploit code for a critical bug in Progress Telerik Report Servers. Threat actors may have exploited a zero-day in older iPhones, Apple warns. Nation-state ...
11 months ago Securityaffairs.com CVE-2024-0769 CVE-2022-38028 CVE-2023-49103 CVE-2023-46747 CVE-2023-46748 CVE-2023-4966 APT28

Hacker leaks millions of new 23andMe genetic data profiles - A hacker has leaked an additional 4.1 million stolen 23andMe genetic data profiles for people in Great Britain and Germany on a hacking forum. Earlier this month, a threat actor leaked the stolen data of 1 million Ashkenazi Jews who used 23andMe ...
1 year ago Bleepingcomputer.com Rocke Hunters

Trello API abused to link email addresses to 15 million accounts - An exposed Trello API allows linking private email addresses with Trello accounts, enabling the creation of millions of data profiles containing both public and private information. Trello is an online project management tool owned by Atlassian that ...
1 year ago Bleepingcomputer.com

New Attack Exploiting X/Twitter Advertising Display URL Feature to Trick Users - Cybersecurity researchers have uncovered a campaign that tricks users by displaying trusted domain names in advertisements while redirecting victims to malicious cryptocurrency scam websites. This technique was previously reported by Bleeping ...
1 month ago Cybersecuritynews.com

Threat actors misuse OAuth applications to automate financially driven attacks - Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. Threat actors compromise user accounts to create, modify, and grant high privileges to OAuth applications that they can misuse to hide malicious ...
1 year ago Microsoft.com

Co-op confirms data theft after DragonForce ransomware claims attack - These threat actors are experts at using social engineering attacks, SIM Swapping, and MFA fatigue attacks to breach networks and then steal data or deploy ransomware. However, soon after the news broke, BleepingComputer learned that the ...
1 month ago Bleepingcomputer.com Dragonforce Scattered Spider

How to Overcome the Most Common Challenges with Threat Intelligence - Today's typical approach to threat intelligence isn't putting organizations in a place to do that. Instead, many threat intelligence tools are delivering too much uncurated and irrelevant information that arrives too late to act upon. Organizations ...
1 year ago Cyberdefensemagazine.com Hunters

Threat Actor Leaked Data from Major Bulletproof Hosting Medialand - A significant data breach occurred when an unidentified threat actor leaked internal data from Medialand, a major bulletproof hosting (BPH) provider with extensive ties to cybercriminal operations worldwide. ????️ On March 28, 2025, a threat actor ...
2 months ago Cybersecuritynews.com

Threat Intelligence Feeds Flood Analysts With Data, But Context Still Lacking - By combining external threat data with internal risk assessments, contextual threat intelligence helps organizations measure the risk level of alerts or vulnerabilities in relation to their business and technical assets, ensuring that the most ...
2 months ago Cybersecuritynews.com

Buzzing on Christmas Eve: Trigona Ransomware in 3 Hours - In late December 2022, we observed threat actors exploiting a publicly exposed Remote Desktop Protocol host, leading to data exfiltration and the deployment of Trigona ransomware. On Christmas Eve, within just three hours of gaining initial access, ...
1 year ago Thedfirreport.com Trigona

23andMe confirms nearly 7 million customers affected in data leak - Nearly 7 million 23andMe customers had their profile data leaked in a cybersecurity incident in October, a company spokesperson confirmed to SC Media on Monday. The vast majority of the leaked data was scraped from the site's DNA Relatives feature ...
1 year ago Packetstormsecurity.com

How to Use Threat Intelligence Feeds for SOC/DFIR Teams - Threat intelligence feeds provide real-time updates on indicators of compromise, such as malicious IPs and URLs. Security systems can then ingest these IOCs to identify and block potential threats, which essentially grants organizations immunity to ...
1 year ago Cybersecuritynews.com

What Is Threat Modeling? - Threat modeling emerges as a pivotal process in this landscape, offering a structured approach to identify, assess, and address potential security threats. Threat Modeling Adoption and Implementation The successful adoption of threat modeling within ...
1 year ago Feeds.dzone.com

Top 7 Cyber Threat Hunting Tools for 2024 - Cyber threat hunting is a proactive security measure taken to detect and neutralize potential threats on a network before they cause significant damage. To seek out this type of threat, security professionals use cyber threat-hunting tools. With ...
1 year ago Techrepublic.com

What Is Cyber Threat Hunting? - Cyber threat hunting involves proactively searching for threats on an organization's network that are unknown to traditional cybersecurity solutions. A recent report from Armis found that cyber attack attempts increased by 104% in 2023, underscoring ...
1 year ago Techrepublic.com

Dell API Abused to Steal 49 Million Customer Records in Data Breach - The threat actor responsible for the recent Dell data breach stated that he scraped information from 49 million customer records via a partner portal API that he accessed as a phony organization. Dell had begun sending alerts to customers informing ...
1 year ago Cysecurity.news

GTA 5 source code reportedly leaked online a year after RockStar hack - The source code for Grand Theft Auto 5 was reportedly leaked on Christmas Eve, a little over a year after the Lapsus$ threat actors hacked Rockstar games and stole corporate data. Links to download the source code were shared on numerous channels, ...
1 year ago Bleepingcomputer.com LAPSUS$ Scattered Spider Akira

Automating Threat Intelligence Enrichment In Your SIEM With MISP - In conclusion, automating threat intelligence enrichment between MISP and your SIEM using Python is a transformative step for any security operations center. This article explores how to architect, implement, and operationalize automated threat ...
2 months ago Cybersecuritynews.com