X, formerly known as Twitter, has been making headlines recently, with Elon Musk claiming that hackers have been trying to disrupt the platform. However, the most recent news involving the social media site is particularly alarming and puts its users at serious risk. 

Earlier this month, reports emerged of a major data breach involving X, after a self-proclaimed data enthusiast known as “ThinkingOne” claimed to have released a database containing over 200 million user records on a popular hacker forum. The leaked data includes names, email addresses and nearly everything else associated with a user’s X profile.

Stay protected & informed! Get security alerts & expert tech tips – sign up for Kurt’s ‘The CyberGuy Report’ now.

What you need to know

The X data leak is believed to stem from a combination of breaches, including a massive one that allegedly occurred in January 2025 and another in 2023. The leaked dataset, reportedly a 34 GB CSV file, contains 201,186,753 entries with information such as X screen names, user IDs, full names, locations, email addresses (from the 2023 breach), follower counts, profile data, time zones and profile images.

ThinkingOne claimed that the data was cross-referenced from a larger breach involving 2.8 billion unique Twitter IDs and screen names. This breach may have been linked to an insider job during layoffs at X, although the company has not verified this claim. Cybersecurity researchers, including those from Safety Detectives, partially confirmed the authenticity of the data by matching a sample with public X profiles and verifying some email addresses. However, they were not able to fully confirm ownership.

The breach appears to trace back to a vulnerability identified in January 2022 through Twitter’s bug bounty program. This flaw allowed attackers to access user data using only an email address or phone number. Although the vulnerability was patched, the compromised data seems to have resurfaced in later leaks.

MALWARE EXPOSES 3.9 BILLION PASSWORDS IN HUGE CYBERSECURITY THREAT

The data breach puts X users at risk

The 2025 incident alone does not include passwords or financial information, but when combined with the email addresses from the 2023 leak, it significantly increases the risk of phishing and social engineering attacks. X has not officially acknowledged this specific breach at the time of writing, although it previously downplayed the 2023 incident by claiming it involved mostly public data.

The total of 2.8 billion records far exceeds X’s estimated 335 to 600 million active users, suggesting that the dataset may include inactive accounts, bots or historical data. While the full scope and impact of the breach remain unclear, the incident highlights ongoing security challenges for the platform, especially following its acquisition by xAI in late March 2025.

HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET

7 ways you can stay safe from the X data breach

If you have an account on X or think your data may have been part of the breach, here are seven important steps you can take to protect yourself.

1) Use strong antivirus software 

This breach included email addresses linked to X accounts, prime fuel for phishing attacks. Hackers may now send emails that look like they’re from X, Musk or support, asking you to “verify your account” or “reset your password.” These often contain links or attachments that can install malware or steal personal data.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

2) Remove your personal data from the internet

Since this X leak exposed full names, email addresses and other public-facing profile details, hackers can easily cross-reference it with other data broker sites to build a full profile on you. This could lead to impersonation or spear-phishing.

To reduce your exposure, use a trusted data removal service that scans data broker websites and requests the deletion of your personal information. While no service promises to remove all your data from the internet, having a removal service is great if you want to monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here.

3) Change your X account password

Even though this particular breach may not have included passwords, there’s still a significant risk, especially if you use the same password across multiple platforms. Once attackers have your email, they often try using it with common or previously leaked passwords to break into accounts.

To change your X account password, go to Settings and privacy from your profile menu, then select Your account and tap on Change your password. Enter your current password, set a new strong password and confirm the change. You can do this via the mobile app or by logging in through the web. Consider using a password manager to generate and store complex passwords. Get more details about my best expert-reviewed password managers of 2025 here.

4) Make your X profile more private to reduce future risk 

Adjust your X account’s privacy settings to limit the visibility of personal information, such as making your profile private. Ensure that only necessary information is publicly visible. Information that seems harmless, like your location, job title or birthday, can be used by cybercriminals to impersonate you or guess your login credentials. If your X profile includes any personal details that aren’t necessary, now is the time to remove them.

Keeping your profile minimal not only protects your privacy but also makes it harder for scammers to craft convincing phishing messages or social engineering attacks. Think twice before posting personal updates or details publicly, especially if they can be used to guess passwords or verify your identity.

Go to Settings > Privacy and safety and lock down your account visibility.

5) Enable two-factor authentication (2FA) for your X and email accounts 

If hackers got your email from the X breach, they may try to reset your password. 2FA helps stop this by requiring a second code to log in:

• Use an authenticator app like Google Authenticator or Authy, not SMS, which can be intercepted
• Secure your email accounts, too, since they can be used to reset your X credentials

6) Use a VPN on public Wi-Fi 

Protect your data when accessing X or other platforms on public networks by using a VPN to encrypt your connection. This will help safeguard your information from being intercepted by malicious actors. A reliable VPN is essential for protecting your online privacy and ensuring a secure, high-speed connection. For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices.

7) Sign up for identity theft protection to catch if your X-linked info is abused

With 200-plus million names and email addresses exposed, scammers may try opening accounts in your name or use your email in fraud attempts. Good identity protection can alert you if your info is being sold on the dark web. It can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. See my tips and best picks on how to protect yourself from identity theft.

NEW PHISHING SCAM OUTSMARTS SECURITY CODES TO STEAL YOUR INFO

Kurt’s key takeaway

The X breach is yet another reminder that patching a vulnerability is only one piece of a much larger puzzle. The persistence of leaked data – years after the original flaw was disclosed and fixed – highlights the long tail of exposure that comes with large-scale breaches. Even when credentials aren’t involved, the combination of identifiers like email addresses, names and social connections can be weaponized through correlation attacks, data enrichment and AI-assisted social engineering.

Do you feel that companies are doing enough to protect your data from hackers and other cyber threats? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com. All rights reserved.