Short answer: A large X/Twitter dataset was reportedly posted on BreachForums in March 2025, and a 34 GB CSV was said to contain 201,186,753 records with email addresses and account information. Researchers found that a sample appeared genuine.
That does not prove that X suffered a newly confirmed attack affecting 200 million unique people. SpyCloud reported that the larger email-containing collection combined an alleged newer dataset with information from an earlier 2023 Twitter exposure. The safest description is a large circulating dataset with at least some apparently valid records—not a verified count of newly breached X users.
As an Amazon Associate I earn from qualifying purchases.
What was allegedly exposed?
Reporting published by Mashable on April 1, 2025 said a BreachForums user identified as ThinkingOne posted a CSV of approximately 34 GB containing 201,186,753 entries.
Recommended Free Tools
The reported fields included:
- Email addresses
- X/Twitter usernames or screen names
- User IDs and names
- Locations and time zones
- Follower counts
- Account creation dates
- Profile information, images, or related metadata
These are records or entries, not automatically unique users. A record can be duplicated, outdated, associated with a deleted account, or linked to a bot or other automated account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why “200 million users” is too definitive
The 200-million-plus figure refers to a collection containing email-linked records. It does not establish that 200 million unique human beings were newly affected.
ThinkingOne allegedly claimed that a separate archive concerned roughly 2.8 billion X/Twitter accounts and exceeded 400 GB. Those figures came from the forum poster and were not independently established as the number of genuine people affected. The archive could have included bots, spam accounts, duplicates, inactive accounts, deleted or deactivated accounts, and historical data.
There is also an important difference between:
- Newly exfiltrated information: data obtained from a recent unauthorized intrusion.
- Previously leaked information: data already circulating from an earlier incident.
- Merged data: records joined from several sources.
- Public profile data: information visible on profiles or inferable from them.
Those categories can appear together in one underground dataset, but they have different implications for both the scale of the incident and the risk to users.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The connection to the 2023 Twitter exposure
SpyCloud reported that the 200-million-plus email-containing collection combined an alleged newer X/Twitter dataset with email data associated with the earlier 2023 Twitter breach.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The 2023 exposure involved account information obtained through an API vulnerability and was widely reported to include email addresses and related profile data. The later collection should therefore not automatically be treated as one uninterrupted attack or as proof that every address was stolen in 2025.
A person may appear more than once, may be represented by an old email address, or may have data from different dates combined into one record. Former X users are not necessarily protected simply because they deleted their accounts: copied data from an earlier exposure can continue circulating independently of the platform.
What researchers verified—and what they did not
SafetyDetectives reportedly examined a sample and found account information and email addresses that appeared valid. That supports the conclusion that at least some records were genuine.
It does not prove:
- That the entire dataset is authentic
- That all records came from X
- That the information was obtained in 2025
- That every address is current or controlled by the same person
- That the records belong to unique human users
- That X’s production systems were newly breached
SpyCloud’s ingestion of the alleged data into its commercial intelligence platform supports the existence of a circulating collection. It is not, by itself, proof of the poster’s acquisition method or of the collection’s complete accuracy.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Were passwords, direct messages, or financial details exposed?
The reporting reviewed for this incident did not establish that the collection included passwords, direct messages, payment-card information, or authentication tokens. Do not assume that an email address and public profile data give an attacker direct access to an X account.
However, an email address can still matter financially. If you reused your X password elsewhere, attackers may try that password on banking, shopping, email, or payment accounts. A convincing message that combines your name, username, location, and other profile details can also make a phishing attempt appear legitimate.
MITRE ATT&CK identifies email addresses and identity information as reconnaissance data that can support phishing, targeting, and account-compromise attempts.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhy the leak can create real risk without passwords
The likely risks are primarily targeted scams and privacy harms:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Phishing: fake messages claiming to be from X support, an advertiser, a journalist, or an account-verification team.
- Credential stuffing: attempts to reuse passwords exposed in unrelated breaches.
- Impersonation: messages that use your public identity or account history to persuade contacts.
- Deanonymization: combining an email address with a pseudonymous account, name, location, or profile image.
- Harassment and doxxing: joining profile details with information from other databases.
- Financial fraud: social engineering aimed at obtaining payment details, tax information, account-recovery codes, or access to your email.
An exposed email address is not the same thing as an account takeover. It is an ingredient that can make later attacks more credible.
What X has confirmed
The reporting supplied for this incident did not provide a substantive public X confirmation verifying the alleged 2025 breach. That should be stated carefully: no confirmation was located in the reviewed reporting, which is different from proving that X had no response or that the allegation was false.
For later company disclosures and transparency materials, consult X’s Transparency Center. Platform settings and security guidance can change, so check X’s current help pages and account menus before acting.
What X users should do now
- Change reused passwords. If your X password was used on another service, replace it there immediately with a unique password.
- Secure your email account. Use a unique password and multifactor authentication. An attacker who controls your mailbox may be able to reset other accounts.
- Enable multifactor authentication on X. Prefer an authenticator app, passkey, or security key over SMS where available. Register a backup method or second security key so you do not lock yourself out.
- Review account activity. Look for unfamiliar logins, profile changes, password-reset messages, or recovery-address changes.
- Remove suspicious connected apps. Revoke third-party applications you no longer recognize or use.
- Treat unexpected messages as suspicious. Do not click links in unsolicited X-related emails. Open X directly through your normal app or bookmark instead.
- Check exposure safely. A reputable breach-notification service such as Have I Been Pwned may show whether an address appears in known datasets. A clean result does not prove that the address was absent from this alleged collection.
- Do not download leak archives. They may contain malware, illegal personal information, or traps designed to collect additional credentials.
Special cases to consider
Former users: Information from a past account may continue circulating after deletion.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Pseudonymous users: The greatest harm may be loss of anonymity rather than account access.
People who reused passwords: The highest-priority action may be changing passwords on unrelated services, particularly email and financial accounts.
High-profile targets: Journalists, activists, executives, public officials, and administrators should expect more tailored impersonation attempts and consider a phishing-resistant security key.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Disposable-email users: Risk to a primary inbox may be lower, but document recovery details carefully and do not assume an alias makes an account invulnerable.
Bottom line
The credible part of the story is that a very large X/Twitter-related dataset circulated and that samples appeared to contain genuine email-linked account records. The unresolved part is just as important: the evidence does not prove a new breach of 200 million unique legitimate users, and the dramatic 2.8-billion-account claim remains unverified. The collection may combine older 2023 data with newer material, public profile information, duplicates, stale records, bots, and deleted accounts.
For users, the practical response is straightforward: stop reusing passwords, secure the email account connected to X, enable phishing-resistant multifactor authentication where possible, and be especially skeptical of personalized account-support messages.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
