Update | 3:54 p.m. TechCrunch has published some financial projections of Twitter. For the end of 2013: 1 billion users, $1.54 billion in revenue, 5,200 employees and $111 million in net earnings. More information at end of this post.
Update | 2:30 p.m. Adding statements from Twitter and Google.
Twitter, which is generally quite private about its business plans, has fallen prey to an attack by a hacker who has apparently exposed confidential corporate information.
The hacker claims to have private documents, including confidential contracts with Nokia, Samsung, Dell, AOL and Microsoft; the résumés of people who have applied to work at Twitter; personal information about Twitter employees, including credit card numbers; future business plans; and floor plans and security codes for Twitter’s offices.
The breach occurred in May, but on Wednesday, the hacker, who calls himself “Hacker Croll,” leaked a large number of documents unearthed in the attack to TechCrunch and a French blog called Korben. TechCrunch said it received 310 documents.
One internal document the hacker claims to have includes projections that Twitter will have 25 million users this year, 100 million next year and 350 million in 2011, and will eventually become the first Web service to have 1 billion users.
The hacker apparently broke into the Internet accounts of various Twitter employees, including Evan Williams, Twitter’s chief executive, as well as Mr. Williams’s wife, who does not work for Twitter, and two Twitter employees. He claims to have accessed Google Apps, Gmail, PayPal, Amazon, Apple, AT&T and MobileMe accounts.
Biz Stone, one of Twitter’s co-founders, wrote on the company blog Wednesday that the hacker broke into an administrative employee’s personal e-mail account and from there gained access to the employee’s Google Apps account, where Twitter shares calendars, spreadsheets and documents with ideas and financial details.
He said that private company documents were stolen, but Twitter user information was not. “As they were never meant for public communication, publishing these documents publicly could jeopardize relationships with Twitter’s ongoing and potential partners,” Mr. Stone wrote.
Mr. Stone said the attack was not the result of a flaw in Google or other Web applications, but that “it speaks to the importance of following good personal security guidelines such as choosing strong passwords.”
Both of the blogs that have the documents have, so far, been circumspect and have not published any sensational information.
Instead of circumventing any actual security measures, the hacker managed to correctly answer the personal questions that some Internet sites ask when users need to reset their passwords.
The hacker posted screen shots of the various accounts at the time and claimed to have also gotten control of Twitter’s domain name account, which would have allowed him to redirect Twitter visitors to another site.
On Tuesday, Mr. Williams confirmed the break-in to TechCrunch and said that no Twitter user accounts were compromised. Mr. Williams said the hacker did access a Twitter employee’s account and his wife’s Gmail account, where he found information like Mr. Williams’s personal credit card numbers.
“Obviously, this was highly distressing to myself, my wife, and other Twitter employees who were attacked,” Mr. Williams told TechCrunch. “It was a good lesson for us that we are being targeted because we work for Twitter. We have taken extra steps to increase our security, but we know we can never be entirely comfortable with what we share via e-mail.”
The attack could reinforce the notion that storing sensitive documents on cloud-based Web services, like Gmail, is dangerous for companies and celebrities.
“Using Google apps and Gmail is great for personal use,” said Lori MacVittie, a technical marketing manager with the networking firm F5 Networks. “But from a corporate perspective, I just can’t see putting something out there that is so able to be compromised and has been on numerous occasions in the past.”
A Google spokesman said: “We are highly aware of the importance of our users’ data, and we have extensive policies and procedures in place to help provide high levels of data protection.” He said he could not comment on the specifics of this situation.
So far, the person behind the French blog, whom the BBC identified as Manuel Dorne, has only released some relatively innocuous information and has gone so far as to blur out what is written on images of Twitter merchandise like T-shirts and baseball caps. He said he was doing so because he was a fan of Mr. Williams and Twitter.
TechCrunch, run by Michael Arrington, said it had spent hours deciding which documents to publish and had determined that it would not publish floor plans, office security codes or résumés of people who applied to Twitter but remain at other companies. It said it would, however, publish documents with business plans and projections. It has already posted a pitch for a Twitter TV show, news of which leaked in the spring.
Internet commenters are torn over whether the hacked documents should be made public. Hundreds of readers responded to TechCrunch, many saying the blog should not publish the confidential documents.
Last September, in a similar attack, a hacker gained access to vice presidential candidate Sarah Palin’s Yahoo e-mail account by using her birthday and ZIP code and correctly answering the security question about where she met her spouse. Her personal e-mail messages were then published by the gossip site Gawker.
Both episodes demonstrate that the risks of exposure are particularly high for people who live their lives out in the open and whose personal details are widely known.
“A lot of the Twitter users are pretty much living their lives in public,” said Chris King, director of product marketing of Palo Alto Networks. “If you broadcast all your details about how you are living your life and what your dog’s name is and what your hometown is, it’s not that hard to figure out a password. Those are the pretty typical questions that people use for password recovery.”
The hacker also seems to have wanted to reinforce that notion. In an e-mail to Korben, the French blog, he wrote that he hoped his attack would make internet users “conscious that no one is protected on the Net.”
“Security starts with simple things like the secret questions, whose utility many people ignore, and the impact that that can have on their private lives if a pirate was able to circumvent them,” he wrote.
TechCrunch has published some financial information:
Twitter expected their first revenue to come in Q3 2009 (which is now). A modest $400,000 was expected, followed by a more robust $4 million in Q4. The document also shows Twitter’s projected user growth (25 million by the end of 2009), which it has absolutely blown through already. By the end of 2010, Twitter expected to be at a $140 million revenue run rate.
Comments are no longer being accepted.