Proprietary Twitter code was sitting in a GitHub repository from early January to sometime in March. Inside anonymous sources believe that the source code leak was perpetuated by a former employee that was laid off when Musk took over.
SMS-based 2FA is by far the most commonly used method for added account security beyond the password. Twitter users that rely on it to secure their accounts will have to come up with another option by March 20.
Twitter’s statement on the data leak (or lack thereof) said only that the company had seen no evidence of a breach of its internal systems and that the prior API scraping issue was not the source of the information.
The Twitter whistleblower report was filed with the DOJ, FTC, SEC and a number of relevant congressional committees. It describes ongoing lax security and privacy practices that are repeatedly papered over by top executives.
Twitter says that the security breach occurred in December 2021, but was not public knowledge until July 21 of this year. An attacker using a zero-day was able to capture phone numbers and email addresses from anonymous accounts.