section_path: Technology/Security
section_name: Security
paragraph_text: Security
  
  In response to early Twitter security breaches, the United States Federal Trade Commission (FTC) brought charges against the service; the charges were settled on June 24, 2010. This was the first time the FTC had taken action against a social network for security lapses. The settlement requires Twitter to take a number of steps to secure users' private information, including maintenance of a "comprehensive information security program" to be independently audited biannually. After a number of high-profile hacks of official accounts, including those of the Associated Press and The Guardian, in April 2013, Twitter announced a two-factor login verification as an added measure against hacking.
  
  On July 15, 2020, a major hack of Twitter affected 130 high-profile accounts, both verified and unverified ones such as Barack Obama, Bill Gates, and Elon Musk; the hack allowed bitcoin scammers to send tweets via the compromised accounts that asked the followers to send bitcoin to a given public address, with the promise to double their money. Within a few hours, Twitter disabled tweeting and reset passwords from all verified accounts. Analysis of the event revealed that the scammers had used social engineering to obtain credentials from Twitter employees to access an administration tool used by Twitter to view and change these accounts' personal details as to gain access as part of a " smash and grab " attempt to make money quickly, with an estimated US$120,000 in bitcoin deposited in various accounts before Twitter intervened. Several law enforcement entities including the FBI launched investigations into the attack.
  
  On August 5, 2022, Twitter disclosed that a bug introduced in a June 2021 update to the service allowed threat actors to link email addresses and phone numbers to twitter user's accounts. The bug was reported through Twitter's bug bounty program in January 2022 and subsequently fixed. While Twitter originally believed no one had taken advantage of the vulnerability, it was later revealed that a user on the online hacking forum Breach Forums had used the vulnerability to compile a list of over 5.4 million user profiles, which they offered to sell for $30,000. The information compiled by the hacker includes user's screen names, location and email addresses which could be used in phishing attacks or used to deanonymize accounts running under pseudonyms.