On December 24, 2019, we became aware that someone was using a large network of fake accounts to exploit our API and match usernames to phone numbers. We immediately suspended these accounts and are disclosing the details of our investigation to you today. We are disclosing this out of an abundance of caution and as a matter of principle. It is possible that some of these IP addresses may have ties to state-sponsored actors. We observed a particularly high volume of requests coming from individual IP addresses within Iran, Israel, and Malaysia.”]
Source: https://privacy.twitter.com/en/blog/2020/an-incident-impacting-your-account-identity