The X (Twitter) 2.8 billion record leak claim: what is actually confirmed

Key takeaways

• A large data set was claimed to be a fresh breach of 2.8 billion X accounts in early 2025.
• Independent review found overlap with older and already-public data, so the real scope is disputed.
• X has not confirmed a breach of this scale; check for an official statement before repeating the figure.
• Mostly public profile data in a leak is still useful to attackers for phishing and account targeting.
• Protect your account with a strong unique password, MFA and caution with suspicious messages, regardless of the exact figure.

What was claimed?

In early 2025 a threat actor using the handle "ThinkingOne" claimed to be selling or sharing roughly 400GB of data said to cover about 2.8 billion X (formerly Twitter) user records. The claim circulated widely under headlines describing it as the largest social media breach in history.

What did independent review find?

Security researchers who examined samples, including coverage at Cybernews, reported that much of the data overlapped with older datasets that had circulated before, including information that was already publicly visible on profiles, such as usernames, follower counts and bios, rather than private data such as passwords. This does not confirm there was no new element at all, but it means the headline figure and the "massive new breach" framing should be treated with real scepticism until X or an independent, named investigation confirms the scope.

Has X confirmed a breach?

At the time this was written, no confirmed statement from X establishing a breach of this scale was available to cite. The editor should check X's official security communications and any formal regulatory notification before this article asserts a confirmed breach.

Why does this matter even if it is mostly old or public data?

A large, organised collection of usernames, emails (where present), bios and follower data is still useful to attackers for:

• Targeted phishing, because attackers can personalise messages.
• Account enumeration, linking usernames across platforms.
• Credential stuffing, if any of the data includes emails tied to accounts that reuse passwords elsewhere.

So the practical advice to users is the same whether the dataset is new or recycled.

What should X users do?

1. Use a strong, unique password for X, not reused elsewhere.
2. Enable multi-factor authentication, preferably an authenticator app or security key rather than SMS.
3. Be cautious of unexpected messages referencing your account or claiming a breach, since scammers exploit the news itself.
4. Check login activity in account settings for unfamiliar sessions.
5. Do not click links in unsolicited "check if you were breached" messages. Use a reputable, independent breach-checking service directly, not a link someone sent you.

How should you evaluate the next "billion record leak" headline?

Ask: who is the source, has an independent party reviewed a sample, has the platform confirmed it, and does the data show signs of being recycled from older leaks. Large numbers attract attention and are not proof by themselves.

Where does this fit in cybersecurity learning?

Understanding how breach claims are verified, and how to separate hype from confirmed fact, is a core skill for threat intelligence work. Related reading: the 16 billion leaked passwords story, which involved similar questions about aggregation and recycled data.

Next steps

To build skills in verifying breach claims and threat intelligence, see our CTIA course. For a related story on data aggregation claims, read 16 billion passwords leaked.