A hacker who goes by the name "Ryushi" has purportedly obtained personal identifying information of up to 400 million Twitter Accounts, and if asking for $200,000 before they delete it, according to the BBC.
"I'm selling data of +400 million unique Twitter users that was scraped via a vulnerability," the threat actor posted on a hacking message board on December 23. "This data is completely private and it includes emails and phone numbers of celebrities, politicians, companies, normal users, and a lot of OG and special usernames."
While the data was obtained in 2021 through means which have already been patched, the threat actor has taken to calling Twitter CEO Elon Musk out.
"Twitter or Elon Musk if you are reading this you are already risking a GDPR fine over 5.4m breach imaging the fine of 400m users breach source," Ryushi posted online. "Your best option to avoid paying $276 million USD in GDPR breach fines like Facebook did (due to 533m users being scraped) is to buy this data exclusively."
A sample size revealed shows the information gathered from celebrities or politicians such as Alexandria Ocasio-Cortex and Donald Trump Jr. Included in the package are users' names, emails, and phone numbers. According to BleepingComputer, the threat actor has stated that if Twitter does not meet their demands, they will begin to sell the package to others for $60,000.