Seen today:
A bug affecting one of our APIs
On Monday, September 10, we identified a bug that may have sent one or more of your Direct Messages or protected Tweets (if your account was protected at the time) to Twitter developers who were not authorized to receive them. The issue has persisted since May 2017, but we resolved it immediately upon discovering it. Our investigation into this issue is ongoing, but presently we have no reason to believe that any data sent to unauthorized developers was misused. Learn more. We regret the incident and sincerely apologize for the error. No action is required from you. However, if you have any questions or concerns regarding this incident, you can contact Twitter via the privacy policy inquiry page.
The fuller message on their site reads as follows:
We recently discovered a bug in our Account Activity API (AAAPI). This API allows registered developers to build tools to better support businesses and their communications with customers on Twitter. If you interacted with an account or business on Twitter that relied on a developer using the AAAPI to provide their services, the bug may have caused some of these interactions to be unintentionally sent to another registered developer. In some cases this may have included certain Direct Messages or protected Tweets, for example a Direct Message with an airline that had authorized an AAAPI developer. Similarly, if your business authorized a developer using the AAAPI to access your account, the bug may have impacted your activity data in error.
It is important to note that based on our initial analysis, a complex series of technical circumstances had to occur at the same time for this bug to have resulted in account information definitively being shared with the wrong source. More here.
Key updates:
- The bug ran from May 2017 and within hours of discovering it on September 10, 2018, we shipped a fix to prevent data from being unintentionally sent to the incorrect developer.
- The bug affected less than 1% of people on Twitter.
- Any party that may have received unintended information was a developer registered through our developer program, which we have significantly expanded in recent months to prevent abuse and misuse of data.
What’s next?
- If your account was affected by this bug, we will contact you directly through an in-app notice and on twitter.com.
- We have contacted our developer partners and are working with them to ensure that they are complying with their obligations to delete information they should not have.
- Our investigation is ongoing. We will continue to provide updates with any relevant information.
We’re very sorry this happened. We recognize and appreciate the trust you place in us, and are committed to earning that trust every day. For more on our updated API policies and how to monitor the apps you are using on Twitter, see here and here.