Although, according to Twitter, the bug has been fixed and there is “no indication of breach or misuse by anyone” after an investigation was conducted. From Twitter:
“We recently found a bug that stored passwords unmasked in an internal log. We fixed the bug and have no indication of a breach or misuse by anyone. As a precaution, consider changing your password on all services where you’ve used this password”.
The bug infiltrated the hashing process Twitter uses to disguise users’ password. This process generates a random set of numbers and letters and replaces your password with it. According to Twitter, the bug caused the passwords to be openly stored to an internal log before the completion of the hashing process.
“We mask passwords through a process called hashing using a function known as bcrypt, which replaces the actual password with a random set of numbers and letters that are stored in Twitter’s system. This allows our systems to validate your account credentials without revealing your password. This is an industry standard.
Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again”.
Although Twitter did not confirm the number of affected passwords, Reuters stated a source who said a “substantial amount of passwords were affected” and they have been exposed for “several months”.
If you are using Twitter, it’s safe for you to change the passwords of any other account or services that share the same password with your Twitter account. Also, you should consider enabling two-factor authentication.