Class action lawsuit claims Twitter API defect allowed data breach

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Twitter class action lawsuit overview:

• Who: Plaintiff Stephen Gerber has filed a class action lawsuit against Twitter Inc.
• Why: Twitter allegedly failed to protect users’ personal identifiable information and enabled cybercriminals to access usernames and their linked email addresses and phone numbers.
• Where: The Twitter class action lawsuit was filed in California federal court.

A defect in Twitter’s application programming interface (API) allowed cybercriminals to access usernames, email addresses, and passwords from June 2021 through January 2022, according to a class action lawsuit filed Jan. 13 in California federal court.

Plaintiff Stephen Gerber says he used a pseudonym to protect his identity on Twitter so that he could express his thoughts without fear of retribution or embarrassment from his employer and peers.

Gerber’s personal identifiable information (PII) was exposed in the Twitter data breach, the class action lawsuit alleges. Had he known Twitter would fail to adequately protect users’ PII, Gerber says, he would either not have provided identifying information to Twitter or would not have used the social media platform at all.

He says Twitter has failed to notify or contact users who have been affected by this data breach and has not attempted to remediate the damage it has caused them.

Twitter class action says social media company violated its privacy policy and 2011 FTC agreement

The Twitter class action lawsuit points to Twitter’s privacy policy, which describes how the social media company uses the information it collects from users.

“At no point does Twitter disclose in their Privacy Policy that they allow cybercriminals to commandeer Twitter’s API in order to scrape sensitive PII from Twitter and then weaponize or sell that information on the dark web,” the class action lawsuit says.

The alleged defect in Twitter’s API reportedly allowed cybercriminals to “scrape” data from Twitter, including usernames and the email addresses and phone numbers associated with the specific account.

The Twitter data breach effectively de-anonymized Twitter users who had wished to remain anonymous while posting on the social media platform, Gerber alleges.

Gerber claims Twitter violated a 2011 agreement with the Federal Trade Commission that prohibits the social media company from misrepresenting the extent to which it protects nonpublic user data.

As a result of the Twitter data breach, Gerber says, users are at risk of being targeted by phishing attempts, unwanted phone calls and text messages, having their private Twitter accounts and identities exposed, and having their PII available for sale on the dark web.

The Twitter class action lawsuit asserts claims for negligence, breach of contract and violations of California’s Unfair Competition Law.

Were you affected by the Twitter data breach? Tell us what you think of the class action lawsuit in the comments.

Gerber is represented by Israel David and Blake Hunter Yagman of Israel David LLC and Jeff Westerman of Westerman Law Corp.

The Twitter class action lawsuit is Stephen Gerber v. Twitter Inc., Case No. 4:23-cv-00186-KAW, in the U.S. District Court for the Northern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

• Google can’t ‘get away with’ deleting evidence in antitrust lawsuit, judge says
• Class action alleges Apple records users’ private data, activity
• Remote work increases data breach risk, research finds
• Tech class action lawsuits allege product defects, misleading advertising