Twitter says an attacker used its API to match usernames to phone numbers
What happened:
Twitter asks users on sign up to scan their contacts (read: steal and upload them).
If you say no, twitter asks again and again every day / every login until you finally allow it to.
Twitter builds a huge and unnecessary db of users and phone numbers, as well as non-users IDs tied to phone numbers.
Someone uses an API to steal this info that in most cases twitter only collected by tricking their users / forcing it.Anyone affected by this should be suing twitter for even collecting this information! My friend can give away my phone number because of this data collection.