State-sponsored threat actors are believed to have exploited social network Twitter's application programming interface (API) to match usernames to phone numbers.
Twitter discovered an unnamed actor using a large network of fake accounts for the attack on Christmas Eve last year.
The fake accounts have been suspended, and Twitter said they were located in a wide range of countries.
However, Twitter's security staffers noticed that a particularly high volume of API requests came from internet protocol addresses located within Israel, Iran and Malaysia.
These IP addresses may have ties to state sponsored actors, Twitter said.
The social network did not say how many fake accounts were used for the attack, or how many users were targetted.
TechCrunch reported that a researcher, Ibrahim Balic, was able to upload lists with over two billion phone numbers he had generated, and ordered randomly, to Twitter thanks to a flaw in the social network's Android app.
Balic was able to match 17 million phone numbers to user accounts over a period of two months until Twitter blocked the API queries on December 20.
The researcher did not alert Twitter to the vulnerability, but used the phone numbers of high-profile users such as politicians and government officials and set up a WhatsApp group to warn them directly.
7 Dec, 2019 my report? They are fixing 25 Dec, 2019? Im not criminal! pic.twitter.com/Nh2rt4vMmK
— ibrahim baliç (@xb4l1c) February 3, 2020
Twitter said the API endpoint makes it easier for new account holders to find people they might already know who are on the social network.
The API queries only worked against accounts that had the "Let people who have your phone number find you on Twitter" enabled. Also, the accounts needed to have a phone number associated with them, which Twitter used to require of users when it started off as an SMS-based service.
That's when it's used as intended; exploiting the API to match usernames to phone numbers was "beyond its intended use case" Twitter said.
It is no longer possible to query the API and have it return the username associated with a phone number.
Twitter apologised for the data leak but has not said it will contact those affected by it.
