> At that time, we had no evidence to suggest someone had taken advantage of the vulnerability.
They didn't notice that someone managed to scrape 5,485,636 accounts, after they were made aware of the issue?
They didn't notice that someone managed to scrape 5,485,636 accounts, after they were made aware of the issue?
The scraped public data is only interesting if the email address identifies the victim and the public content compromise the victim in some way.
As far as not noticing scraping of the accounts:
If all that is needed to scrape public twitter data is the twitter ID, the site is likely being scraped constantly.
But from an engineering standpoint, they failed to audit a somewhat obscure, (presumably) low-traffic endpoint that received an extraordinary amount of attention. It's kind of wild they're willing to admit such incompetence.
Unless you believe Twitter is dying and few people are signing up, I fail to see how you can characterize that as an obscure, low traffic endpoint.
Edit: On careful reading, it’s actually the onboarding flow, so even if you already have an account you should still hit it when starting to use the app for the first time.