Documented incidentIncident 2020-07-15Twitter (now X)Engineering postmortem

Phone spear-phishing gives attackers Twitter's internal support tools; 130 accounts targeted (2020)

A phone spear-phishing attack on a small number of employees gave attackers credentials to internal support tools on July 15, 2020.

What happened

  • Attackers targeted 130 accounts, reset passwords on 45 of them, and posted tweets soliciting bitcoin.An update on our security incident

The failure pattern

Privileged action without an enforceable approval gateLimits and approvals live in a prompt, a UI checkbox or a convention instead of code the automation cannot bypass.How to prevent it Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it
Watch the pattern: Privileged action without an enforceable approval gate

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Require two-person approval for high-impact account actionsActions such as password resets on high-profile accounts should need a second authorised person.
  • Phishing-resistant authentication and full audit of support toolsProtect internal tool access with hardware keys and log every action with the actor and target.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern