Elon Musks social media platform, X, is facing yet another major data breach. A self-proclaimed data enthusiast, ThinkingOne, has leaked a database containing over 200 million X user records. This follows a 2022 vulnerability exploitation. Despite Xs assurances, concerns remain about user data security and the platforms response to such breaches.
Attackers Exploited X Vulnerability To Grab User Information
The origins of this breach trace back to January 2022, when X, formerly Twitter, discovered a vulnerability through its bug bounty program. The flaw allowed attackers to extract user data using only an email address or phone number. By July 2022, reports emerged that hackers had exploited this vulnerability before it was patched, selling large amounts of user data.
Fast forward to April 2025, and a new actor, ThinkingOne, claims to have obtained and merged data from the 2022 breach with an additional leak from January 2025. The combined dataset contains 201 million records and has been distributed for free on a well-known data breach forum.
ThinkingOne Speaks On The Latest Data Leak
ThinkingOne, who claims to be a data enthusiast rather than a hacker, insists their actions are legal. In an email conversation, they revealed that over 2.8 billion records had been exfiltrated from X. This, they claim, makes it the largest social media breach in history.
They questioned how someone could gather all X user IDs, suggesting either an insider job or a highly sophisticated hack. To verify the leaked data, ThinkingOne checked a random sample of 100 records, of which 92 matched the correct user IDs and screennames.
What X Has Said About The Data Leaks
In January 2023, X released a statement denying any new data breaches linked to its systems. The company acknowledged the 2022 vulnerability but insisted that subsequent leaks were not a result of system exploitation. Xs investigation found that:
- The 5.4 million accounts exposed in August 2022 were consistent with earlier reports.
- Claims of 400 million leaked accounts in a second breach were unverified.
- The dataset of 200 million leaked records had no direct link to an X system vulnerability.
X also asserted that no passwords were compromised in any of these leaks. However, cybersecurity experts warn users to remain cautious and update security settings to mitigate risks.
As this is a developing story, further updates are expected as more information becomes available.
