Back
Outfaze Security Team

Outfaze Security Team

Twitter's 2020 Hack: Privileged Access Lessons

Twitter's 2020 Hack: Privileged Access Lessons

On July 15, 2020, attackers used social engineering to gain access to Twitter's network and internal tools, then took control of high-profile accounts for a cryptocurrency scam. The New York Department of Financial Services later published a detailed investigation.

The incident showed how a small number of privileged support capabilities can affect public communication, financial fraud, customer privacy, and platform trust.

Help-desk pretexting reached internal administration

Attackers called employees while posing as internal IT support and used knowledge of remote-work problems to make the story credible. After reaching internal systems, they targeted employees with access to account-management tools.

Twitter's containment included restricting internal access and limiting some account functions. Those steps reduced attacker capability but also affected legitimate public communication.

Protect powerful support workflows

Inventory which roles can reset credentials, change MFA, impersonate users, access customer data, or alter public content. Require stronger authentication, just-in-time privilege, approval for sensitive actions, and detailed, independently monitored audit logs.

Teach employees to verify support requests through a known channel. Detect unusual sequences such as a help-desk reset followed by privilege use, MFA change, data access, or actions against several high-profile accounts.

  • Biographical and workplace knowledge is not identity proof.
  • Support tools need least privilege and session controls.
  • High-impact actions should require independent approval.
  • Containment plans must consider public communication dependencies.

Put the lesson into practice

  1. Map privileged support tools and user roles.
  2. Add strong verification and just-in-time access.
  3. Monitor sensitive actions and reset-to-access sequences.
  4. Run targeted vishing exercises for support teams.
  5. Test containment without losing all customer communication.

Related Outfaze guidance

Authoritative sources