--- description: The credentials of more than 32 million Twitter users have reportedly been stolen and leaked title: Millions of Twitter Passwords Might Have Just Been Leaked image: https://static.time.com/v3/assets/bltea6093859af6183b/blt47f0d5d069c6c07a/6988936ca988cae4f46b7e06/gettyimages-509341082.jpg?branch=production&width=3840&quality=75&auto=webp&crop=16:9 ---  * [Business](/section/business/) ## Business Update your preferences in [Account Settings](/account/preferences/) Close # Millions of Twitter Passwords Might Have Just Been Leaked by [David Meyer / Fortune](/author/fortune/) ## David Meyer / Fortune Update your preferences in [Account Settings](/account/preferences/) Close Jun 9, 2016 2:19 PM CUT  The Twitter Inc. logo is seen behind an Apple Inc. iPhone 6s displaying the company's mobile application in this arranged photograph taken in New York, Feb. 9, 2016 The Twitter Inc. logo is seen behind an Apple Inc. iPhone 6s displaying the company's mobile application in this arranged photograph taken in New York, Feb. 9, 2016Bloomberg/Getty Images by [David Meyer / Fortune](/author/fortune/) ## David Meyer / Fortune Update your preferences in [Account Settings](/account/preferences/) Close Jun 9, 2016 2:19 PM CUT The credentials of more than 32 million Twitter users have reportedly been stolen and leaked—but with this particular mega-breach, the twist is that it doesn’t seem to have been Twitter itself that was the source of the data. There has recently been a [spate](http://fortune.com/2016/05/31/hacked-data-bonanza/ "undefined") of user credentials from services such as LinkedIn and MySpace turning up in the online underground, but in each of these cases the data appeared to have come from a breach of the service provider’s systems—a tell-tale sign being that the passwords were (badly) encrypted. Those breaches become public through a shadowy site called LeakedSource, that lets people see whether their credentials have been included in particular leaked datasets. LeakedSource is again the conduit for this latest tranche of data, but its proprietors reckon the Twitter credentials were stolen from the users’ browsers. Twitter is also adamant that it wasn’t itself hacked. “We are confident that these usernames and credentials were not obtained by a Twitter data breach—our systems have not been breached,” Twitter said in a statement. “In fact, we’ve been working to help keep accounts protected by checking our data against what’s been shared from recent other password leaks.” In a [blog post](https://www.leakedsource.com/blog/twitter "undefined"), LeakedSource said the dataset included passwords from people who had signed up to Twitter as recently as 2014, but the passwords had been stored in “plaintext,” with no attempt to encrypt them. In line with being a large, prominent web firm, Twitter isn’t so careless with its customers’ data. As Twitter information security officer Michael Coates tweeted: > [](https://twitter.com/%5Fmwc/status/740764470708965376) What’s more, LeakedSource said many passwords in the dataset were listed as “blank,” which is how browsers refer to a user’s password when the user doesn’t choose to store their password along with their login credentials. In short, according to LeakedSource’s theory, whoever stole this data apparently stole it from the users’ browsers. This was most probably done with malware, and it seems to have disproportionately targeted Russians—the most common email address domain in the list is “mail.ru,” with five other Russian email providers also appearing in the top 10. If that’s the case, the thieves probably took more than just Twitter credentials. _This_ [_article_](http://fortune.com/2016/06/09/twitter-hack-malware/ "undefined") _originally appeared on_ [_Fortune.com_](http://Fortune.com "undefined") ```json [{"@context":"https://schema.org","@type":"NewsArticle","@id":"https://time.com/4362568/twitter-account-hack/","mainEntityOfPage":{"@type":"WebPage","@id":"https://time.com/4362568/twitter-account-hack/"},"headline":"Millions of Twitter Passwords Might Have Just Been Leaked","datePublished":"2016-06-09T14:19:00.000Z","dateModified":"2026-02-22T22:29:40.600Z","description":"Change your passwords, everyone","url":"https://time.com/4362568/twitter-account-hack/","keywords":["Social Media","Companies"],"thumbnailUrl":"https://static.time.com/v3/assets/bltea6093859af6183b/blt47f0d5d069c6c07a/6988936ca988cae4f46b7e06/gettyimages-509341082.jpg?branch=production&width=1200&quality=75&auto=webp&crop=1200:675&height=675","author":[{"@type":"Person","name":"David Meyer / Fortune"}],"articleSection":"Business","image":[{"@type":"ImageObject","url":"https://static.time.com/v3/assets/bltea6093859af6183b/blt47f0d5d069c6c07a/6988936ca988cae4f46b7e06/gettyimages-509341082.jpg?branch=production&width=1200&quality=75&auto=webp&crop=1200:675&height=675","width":1200,"height":675,"headline":"Twitter Illustrations Ahead Of Earnings Release","caption":"Twitter Illustrations Ahead Of Earnings Release","creditText":"Bloomberg/Getty Images","representativeOfPage":true}],"publisher":{"@type":"Organization","name":"Time","url":"https://time.com/","logo":{"@type":"ImageObject","url":"https://time.com/images/logo.png","width":528,"height":156},"foundingDate":"March 3, 1923","sameAs":["https://www.facebook.com/time","https://www.instagram.com/time/?hl=en","https://twitter.com/time","https://www.pinterest.com/timemagazine"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/section/business/","name":"Business"}},{"@type":"ListItem","position":2,"item":{"@id":"https://time.com/4362568/twitter-account-hack/","name":"Millions of Twitter Passwords Might Have Just Been Leaked"}}]},{"@context":"https://schema.org","@type":"VideoObject","name":"Mark Zuckerberg’s Social Media Profiles Hacked","description":"Some social media accounts of FB CEO Mark Zuckerberg were temporarily hacked by a group called Ourmine","thumbnailUrl":"https://cdn.jwplayer.com/v2/media/jNY7fMrL/poster.jpg?width=720","uploadDate":"2016-06-06T16:13:49.000Z","contentUrl":"https://cdn.jwplayer.com/manifests/jNY7fMrL.m3u8","embedUrl":"https://time.com/4362568/twitter-account-hack/","duration":"PT50S","potentialAction":{"@type":"SeekToAction","target":"https://time.com/4362568/twitter-account-hack/?jw_start={seek_to_second_number}","startOffset-input":"required name=seek_to_second_number"}}] ```