NEW DELHI: Twitter faces a major security scare as a hacker claims to have accessed personal data of over 400 million users, including high-profile names like Sundar Pichai, CEO of Google, Bollywood actor Salman Khan, Donald Trump Jr., Steve Wozniak, and singer Charlie Puth. The hacker, known online as Ryushi, shared sample data to substantiate the claim.

The alleged breach reportedly includes emails and phone numbers, with the hacker demanding that Twitter or CEO Elon Musk purchase the data to avoid potential fines under the European Union’s General Data Protection Regulation (GDPR). Such fines could reportedly reach up to USD 276 million, similar to penalties faced by other tech companies for large-scale data leaks.

In a message posted online, Ryushi stated:
“Twitter or Elon Musk, if you are reading this, you are already risking a GDPR fine over the 5.4 million user breach. Imagine the fine for a 400 million user breach. Your best option to avoid paying $276 million is to buy this data exclusively.”

Cybersecurity experts have verified portions of the leaked data. Alon Gal, co-founder and chief technology officer at Israel-based cybercrime intelligence firm Hudson Rock, confirmed that the data checked by third parties appears genuine. According to Gal, the breach likely exploited a flaw in Twitter’s API, enabling the hacker to query any email or phone number and retrieve associated Twitter profiles.

This revelation comes in the wake of an ongoing investigation by the Irish Data Protection Commission (DPC) into a previous Twitter data leak affecting 5.4 million users. That earlier incident exposed email addresses, phone numbers, and Twitter handles, highlighting ongoing vulnerabilities in the platform’s data protection measures.

Twitter has yet to issue an official statement on the 400-million-user breach. The incident raises fresh concerns over the social media platform’s ability to safeguard sensitive user information and maintain compliance with global privacy regulations.

New Delhi: India’s gaming sector is entering a pivotal phase as the Digital Personal Data Protection (DPDP) Act comes into force, reshaping how studios collect, store, and use player data.

From Growth at All Costs to Trust-Based Gaming

The updated DPDP Act, effective mid-November, limits personal data collection to clearly defined purposes, requires transparent disclosures, and mandates meaningful opt-out options. The law also strengthens protections for minors and introduces breach notification obligations to both users and the Data Protection Board of India.

Industry leaders note that this shift is moving the sector from rapid, largely unregulated growth to trust-driven engagement. Nitish Mittersain, CEO of Nazara Technologies, emphasized that players and parents are more likely to invest in games when data is handled responsibly, signaling a long-term benefit for studios adopting privacy-first practices.

Compliance Challenges and Industry Response

While larger studios are largely aligned with global privacy norms, smaller developers face challenges in adjusting to stricter compliance requirements. Sridhar Muppidi, president of the Game Developer Association of India, urged government awareness campaigns for smaller studios, warning of severe penalties for non-compliance.

The law’s emphasis on purpose limitation forces companies to rethink longstanding practices such as data hoarding and extensive third-party integrations.

Embedding Privacy by Design

Studios like Felicity Games are responding by implementing privacy by design, including clear consent flows, player dashboards, and additional safeguards for minors. Privacy advocates argue that these measures will encourage more responsible and accountable data usage, ultimately benefiting the sector’s credibility.

Parents, Children, and Player Trust

The regulations are also expected to boost parental confidence in gaming, particularly after prior regulatory disruptions, including bans on real-money gaming. Executives note that stronger data protection could increase engagement and support the growth of high-quality, compliant games.

Stabilising the Sector After Regulatory Whiplash

Following valuation setbacks linked to prior regulatory restrictions, the DPDP Act is viewed less as a constraint and more as a stabilizing framework. By standardising data practices, the law provides a pathway for the Indian gaming industry to rebuild trust with players and policymakers in one of the world’s fastest-growing digital markets.