Twitter’s business customers had their data compromised. What should we do to avoid ending up in the same situation?

To avoid ending up in this situation, we limit in advance what can be lost in a breach: we use a separate email address for social media, unique passwords, two-step verification and a separate card for online payments, with notifications for every transaction. The 2020 Twitter breach shows why.

What happened to Twitter’s business customers’ data?

In June 2020, Twitter (the network has been called X since July 2023) notified its business customers that, because of a vulnerability, some of their sensitive information might have been exposed. Specifically, this meant their email address, phone number and the last 4 digits of their credit card.

No matter how big or small the platform where this data is stored, there’s always a risk that it ends up in the wrong hands. We can’t control the platforms’ security, but we can control what data we give them and how easily it can be used against us.

Which measures limit the damage of a data breach?

RezolvIT’s minimum security recommendations for reducing the impact of a breach like this are the following:

• An email address created specifically for social media and advertising accounts. That way, you won’t get spam at your main address, and if this address is ever compromised, you’ll limit the damage.
• Different passwords for every account, including the email address and the social media account. Use randomly generated or highly complex passwords, kept in a password manager (see the basic rules for secure passwords).
• Two-step verification on email and social media accounts, preferably with an authenticator app rather than SMS.
• A separate card for online payments, such as a virtual card from your bank’s app, with a spending limit and notifications for every transaction. In 2020, some big sites, such as GoDaddy, still hadn’t implemented 3D Secure payment confirmation. Since then, in the European Union, the PSD2 directive has made payment confirmation (usually in the bank’s app) the rule for online card payments. Subscriptions and recurring payments go through without confirmation after the first payment, though, so notifications are still useful.
• Regularly checking the company’s email addresses on Have I Been Pwned, the service that shows whether an address appears in known data breaches.
• Individual access to company accounts. On advertising accounts and company pages, each employee works with their own account, not a shared password, and their access is closed when they leave the company.

Following a minimum set of security rules is absolutely essential, especially as cyberattacks become more frequent. From this point of view, everyone owes it to themselves to stay protected, so they don’t end up with more work later (in this case, back-and-forth with the bank and requests to cancel payments).

RezolvIT places great value on security and backups (Backup as a Service). By securing, we mean both implementing modern security solutions and training users to protect themselves from simple threats, such as spam emails. You’ll find details about our IT security services on their page.