Twitter sued over data leak, denies it was caused by a flaw

New York State resident Stephen Gerber claims his personal information was among a cache of data obtained by hackers between 2021 and 2022. They filed a lawsuit in San Francisco federal court on Friday seeking class-action status for all those whose information was leaked.

Gerber blamed a flaw in Twitter’s application programming interface (API) that allowed cybercriminals to obtain usernames, emails and phone numbers of users of the social media website.

In January, an anonymous user on the hacker site BreachForums published a database that he claimed contained basic information on hundreds of millions of Twitter users. Twitter said in a blog post that “there was no evidence that the data being sold online was obtained by exploiting a vulnerability in Twitter systems.”

“The data is likely a collection of data already publicly available online through various sources,” the company said.

Gerber claims in the complaint that Twitter “burys its head in the sand” and that the company may have tried to hide the magnitude of the leak.

Twitter “to date, has inexplicably failed to notify or contact the victims of this particular API exploit,” Gerber said.

Gerber is seeking unspecified monetary damages, which are likely to exceed $5 million, and a court order requiring Twitter to test and audit its systems as well as security programs designed to protect users’ privacy. Need to hire third party security auditors to implement and maintain

Twitter, which does not have a public relations department, did not respond to an emailed request for comment.

The case is Gerber v. Twitter Inc., 3:23-cv-00186, US District Court, Northern District of California (San Francisco).

The text of this story is published from a wire agency feed without any modification.