“This bug resulted from an update to our code in June 2021.”
A Twitter bug matched phone numbers and emails to accounts, even for users who had hidden them. It was introduced in June 2021, reported in January, and exploited in between. Now 5.4 million records are on sale for $30,000. Pseudonymous activists who trusted the privacy setting are the ones who pay for it.