Twitter Data Leak: 200 Million Emails and What to Do
This was not a break-in at passwords. Someone used a Twitter API flaw to link email addresses to public profiles, and then collected the results.
By Siddharth ShankarUpdated October 20, 2026In January 2021, data was obtained through a Twitter API that matched email addresses to profiles. It appeared on a hacking forum in early 2023 and was added to Have I Been Pwned on January 5, 2023. The set holds 211.5 million email addresses with names, usernames and profile information. No passwords are listed. The main risk is that your private email can be tied to your public account, which helps targeted phishing and unmasking.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
If you ever signed up to Twitter, now X, with an email address, it may sit in this data. The breach matters less for what it contains than for what it links together.
What happened
According to Have I Been Pwned, the data was obtained in January 2021 by abusing an API that allowed someone to match email addresses to Twitter profiles. The resulting data appeared on a hacking forum in early 2023, and Have I Been Pwned added it on January 5, 2023.
What is in the data
The data contains 211.5 million email addresses, along with names, usernames and profile information that was already in public profiles. It is not a leak of passwords. What is new is the link between an email address and an account, which is not something the profile shows publicly.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
Why the link matters
Many people use one email address for their private life and a different handle for public posts. A leak that ties them together can unmask anonymous or pseudonymous accounts. It also hands scammers a name, a handle and an email address that go together, which makes a phishing message believable.
What to do
1Check your email
Use our free email check to see whether your address appears in this and other breaches.
2Secure your account
Use a unique password and turn on two-factor authentication, ideally with an authenticator app rather than SMS.
3Review your sign-up email
If it ties to your real identity and you want separation, change the account email to an alias. See email aliases.
4Be careful with messages
Be suspicious of emails claiming account problems, verification fees or copyright notices. Go to the site directly.
5Review linked accounts
Remove apps you no longer use from your account’s connected apps.
What this tells us about APIs
This was a flaw in how a service responded to lookups, not a hack of a password database. Features like account search and contact import can reveal more than users expect. The same idea is behind Facebook’s People You May Know.
What “public profile data” means in practice
The profile fields in the data were the sort that appear on a public Twitter page: a name, a handle and similar details. That sounds harmless. The point is that these were now connected to a private email address in one large, searchable file, which anyone with the data could query.
Signs of a related phishing attempt
- An email that quotes your handle and says your account is at risk of suspension.
- A message about a copyright complaint or a verification badge that asks you to log in through a link.
- A direct message from a familiar account that contains an odd link.
- A request to pay a fee to keep or recover an account.
If you run a public or business account
Treat the email on the account as a key to the account. Use an address that is not widely known, keep it protected with its own strong password and two-factor authentication, and avoid using it for newsletters and sign-ups. This reduces the impact of any future leak that links addresses to handles.
Related guides
For what to do after any leak, read your email was in a data breach: what to do next. For the other major social media scrape, see the LinkedIn data scrape.
Sources
- Have I Been Pwned: Twitter (200M) breach (January 2021 API, early 2023 forum, added January 5, 2023, 211.5 million emails, data types)
Frequently asked questions
How many Twitter accounts were in the leak?
Have I Been Pwned lists 211.5 million email addresses.
Were passwords exposed?
No passwords are listed. The data is emails with names, usernames and profile information.
How was the data obtained?
By abusing a Twitter API that matched email addresses to profiles, in January 2021.
Why does it matter if profile data was public?
Because the link between a private email address and a public account was not public.
What should I do?
Check your email, use a unique password, turn on two-factor authentication and watch for phishing.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.