Twitter’s recommendation that all of its 330 million users around the world change their passwords highlights how jumpy and anxious companies have become around data.

Last night, Twitter urged its millions of users to change their account passwords, just to be on the safe side. The safe side of what?

Go deeper with GlobalData

Premium Insights

The gold standard of business intelligence.

Find out more

Related Company Profiles

View all

Twitter sent out the communications after discovering what it called a bug, i.e. an internally stored file containing user passwords written in plain text.

In a blog post, the company’s chief technology officer Parag Agrawal explained the problem and reassured users that it had been both identified and addressed.

Nevertheless, Agrawal wrote that the company is urging users to consider changing their passwords “out of an abundance of caution”.

To be clear, there was never any indication that the file of user’s account passwords in question had been misplaced, stolen, or shared with a third-party.

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

But the fact that it existed at all triggered the kind of mass security warning most digital communications providers would prefer not to have to deliver at all – and especially not these days, with the Facebook data privacy scandal still ongoing.

And then, Twitter bumbled the delivery.

Agrawal tweeted a message suggesting that the communication and password change recommendation sent out to users was probably surplus to requirement, but was nevertheless “the right thing to do”.

He then retracted that in a later Tweet: “I should not have said we didn’t have to share. I have felt strongly that we should. My mistake”.

Was it, or wasn’t it, a required step?

Certainly, Twitter has a duty to inform users of all security breaches and leaks, but in this case, we’re talking about a file of plaintext passwords that was discovered somewhere within the bowels of Twitter’s IT systems.

Agrawal referred to the file as a bug. But what created it? We’ll probably never know.

What his blog post adds up to is this: We found a security loophole, and shut it down. We investigated it, and found no evidence to suggest a security breach, but all users should change their password, just in case.

In case, of what?

In case, of course, Twitter is mistaken. In case the file has already been leaked, and a hacker is teeing up those passwords to launch misinformation and communication on a new dimension: Fake news, spread over stolen but nevertheless real Twitter accounts.

Social media bot hacks work on the principle that if you put out a piece of information over enough bots, it will, at one point, be picked up by a real person, with a real account, and spread to friends and family members over social media. It’s a numbers game.

Most social media platforms, notably Twitter, have already made significant steps to identify and shut down tens of thousands of bots, and it’s now recognised that bot-driven public opinion hacking had a hand in the 2016 US Presidential elections.

With access to millions of real Twitter password accounts, tomorrow’s democracy hackers could have the ultimate follow-up.

Sure, it’s a digital doomsday scenario. But in this day and age, its one that we all – including Twitter – need to take more seriously.

So, if you wake up tomorrow to discover your Twitter account spewing a string of outrageous, inflammatory and possibly criminal views that you don’t recognise as being your own, remember: you were warned to change your password. Change it now.