Twitter said Friday it has patched a bug that could have shared users' private messages with software developers outside of the company.
The issue is estimated to have impacted less than 1 percent of Twitter's total user base, which includes 335 million monthly active users as of July. The company has hundreds of partner developers.
The company's stock price hit a day low of $28.49 following the bug's disclosure. Twitter's share price closed at $28.50, down more than 4.5 percent on the day.
"We have no evidence to suggest that any data was improperly misused or exploited anywhere," a company spokeswoman told CNBC, emphasizing that the bug could only occur if a series of complex criteria were met. "There's virtually no possibility that this happened, but we still want to be thorough."
Twitter said it is continuing to investigate the situation. The company said it has also contacted third-party "developers who may have been impacted," the company said in a blog post.
The bug impacted user data between May 2017 and Sept. 10, when it was discovered. The bug was then fixed within hours, the Twitter spokeswoman said. The company waited to disclose the bug "to ensure we were providing the most accurate information," she said.
No private messages between individual users were shared with external software developers, the Twitter spokeswoman said.
Some users reacted to the bug disclosure by tweeting out the notice they received from the company.
Here's Twitter's full statement:
We recently discovered a bug in our Account Activity API (AAAPI). This API allows registered developers to build tools to better support businesses and their communications with customers on Twitter. If you interacted with an account or business on Twitter that relied on a developer using the AAAPI to provide their services, the bug may have caused some of these interactions to be unintentionally sent to another registered developer. In some cases this may have included certain Direct Messages or protected Tweets, for example a Direct Message with an airline that had authorized an AAAPI developer. Similarly, if your business authorized a developer using the AAAPI to access your account, the bug may have impacted your activity data in error.
It is important to note that based on our initial analysis, a complex series of technical circumstances had to occur at the same time for this bug to have resulted in account information definitively being shared with the wrong source. More here.
Key updates:
- The bug ran from May 2017 and within hours of discovering it on September 10, 2018, we shipped a fix to prevent data from being unintentionally sent to the incorrect developer.
- The bug affected less than 1% of people on Twitter.
- Any party that may have received unintended information was a developer registered through our developer program, which we have significantly expanded in recent months to prevent abuse and misuse of data.
What's next?
- If your account was affected by this bug, we will contact you directly through an in-app notice and on twitter.com.
- We have contacted our developer partners and are working with them to ensure that they are complying with their obligations to delete information they should not have.
- Our investigation is ongoing. We will continue to provide updates with any relevant information.
We're very sorry this happened. We recognize and appreciate the trust you place in us, and are committed to earning that trust every day. For more on our updated API policies and how to monitor the apps you are using on Twitter, see here and here.
