Twitter: We accidentally used security data to target users with ads

Twitter does not know how many people were impacted by the error.

Twitter announced Tuesday that email addresses and phone numbers used to secure accounts had accidentally been used for advertising purposes.

In a blog post, the company says the addresses and numbers were used in its “Tailored Audiences” product, which allows advertisers to target ads to customers based on the advertiser’s own marketing lists.

“When an advertiser uploaded their marketing list, we may have matched people on Twitter to their list based on the email or phone number the Twitter account holder provided for safety and security purposes,” the blog states. “This was an error and we apologize.”

Twitter does not know how many people were impacted by the error. The company says no data was shared with third parties that used the Tailored Audiences feature.

Twitter users share phone numbers with the company for security purposes, particularly for its two-factor authentication feature. With that feature, Twitter sends a code to the stored phone number via SMS, which is then used to further authenticate a user’s login.

Security experts have frowned upon using SMS in the two-factor authentication process, mainly due to SIM hijacking, which typically involves hackers posing as their victim in order to transfer a phone number from one device to another.

Other social media networks have moved away from using phone numbers in their two-factor authentication process. In May 2018, Facebook moved away from requiring a phone number to use the service to sign into the company’s platform.

However, Facebook also never explicitly told users it was using those numbers for advertising purposes. That act was among the many reasons the Federal Trade Commission issued a $5 billion fine against the company in July.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure