Twitter 200 million email leak: what it contained and what to do
2 min read · Updated November 8, 2026
In early 2023 a dataset linking more than 200 million email addresses to public Twitter profiles circulated online. It was tied to an API flaw reported in 2022 and contained emails plus public profile details, not passwords. The main risk is targeted phishing, so check your email and lock down your account.
What happened
In 2022 researchers reported a flaw in a Twitter API that let someone submit an email address or phone number and learn which account it belonged to. Twitter said the bug was fixed. In January 2023 a large dataset built from that kind of lookup was posted on a hacking forum.
The company later said it had found no evidence that the data came from a fresh break-in to its systems, and security researchers described it as scraped data. Either way, the result was a searchable list tying private email addresses to public accounts.
What was exposed
- ✓Email addresses, including ones people never made public.
- ✓Public profile details such as display name, username and follower count.
- ✓In some cases, phone numbers linked to the account.
- ✓No passwords were reported in the dataset.
Were you caught up in a major breach?
Old breaches keep circulating for years. Scan your email against known breach records for a one-time $1.99.
Why it still matters
Linking an email to a public account makes it easy to impersonate or target someone. Scammers use that link for convincing phishing, and people who used a private email to stay anonymous could be identified.
Because passwords were not part of it, the leak does not by itself let anyone log in, but it raises the value of every other leaked password tied to the same address.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
- ✓Review which email and phone number are linked to your account and remove ones you no longer use.
Frequently asked questions
Were Twitter passwords leaked?+
No passwords were reported in this dataset. It contained email addresses and public profile information.
Should I change my Twitter password?+
It is not required by this leak alone, but changing it and enabling two-factor authentication is cheap protection, especially if you reuse passwords.
Can scrapers get my private email this way?+
In this case the flaw let them match private emails to public accounts. That is why account lookups by email or phone are now treated as a privacy risk.
Stop guessing. Check your email in seconds.
The Leakill scan looks for your email address in known breach records and delivers a detailed report: the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-time $1.99 payment, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.