Washington, April 2: A hacker known as ThinkingOne has claimed responsibility for leaking a database containing information on more than 200 million users of X (formerly Twitter), according to cybersecurity researchers.
Safetydetective.com, which first reported the breach, said its researchers discovered the dataset on the hacking forum BreachForums in a post by ThinkingOne. The post reportedly included a 34GB downloadable file with over 201 million X user records.
In the forum post, ThinkingOne alleged that the leak was necessary because “neither X nor the general public were aware of the largest social media breach ever.” The hacker also claimed multiple attempts to contact X had gone unanswered.
Safetydetective.com researchers said they verified the leaked data, which includes usernames, full names, locations, email addresses, follower counts, profile details, time zones, and profile images. “We reviewed data from 100 users in the list and found it matched what was shown on Twitter. We also verified a significant number of emails, which turned out to be valid, though we cannot confirm ownership,” the researchers stated.
In an interview with Forbes, ThinkingOne denied being a hacker, calling themselves a “data enthusiast” who ensures their actions remain legal. “This is by far the largest social media breach ever in terms of user numbers, and there’s at least a possibility that the person responsible has additional data, including emails, phone numbers, and passwords,” they said.
While the origin of the breach remains uncertain, ThinkingOne claims the dataset combines information leaked in January 2022 with another breach allegedly leaked in January 2025. “The January 2025 dataset contained over 2.8 billion unique Twitter IDs and screennames,” they told Forbes. “I checked a sample of 100, and 92 had the correct user ID and screen name.”
They further questioned how such a dataset could be compiled, stating: “How could someone enumerate all Twitter user IDs unless they were an employee or this was a very serious hacking job?”
X has not responded to the claims.
