This highlights the need for account takeover protection solutions as users tend to use the same password across multiple accounts

Twitter has asked its 300+ million users to update their passwords after a bug exposed them in plain sight.

Nadav Avital, application security research team leader at Imperva, said: “Anytime, a leak of usernames or email addresses is made available, the anti-fraud technologies monitoring for fraudulent and failed logins see major activity spikes, with large numbers of login attempts using known passwords and large password dictionaries.

"This highlights the need for account takeover protection solutions as users tend to use the same password across multiple accounts. If one service is at risk of a breach, like Twitter, it doesn't take long for attackers to take over other accounts as well.

"I couldn’t agree more with the need for these users to change their passwords to something difficult to crack. There are plenty of resources online that will help you create an effective password.”

Ondrej Kubovic, security awareness specialist at ESET, added: “The good news is that the flaw has been uncovered by Twitter itself – or at least that’s what the company claims in its statement - thus there’s a good chance it hasn’t been misused by anyone. Yet, we would still advise users to follow the social network’s recommendation and change their password to ensure security of their Twitter account.

"This incident offers an opportunity for users to: a) improve the quality of their password (length and uniqueness) and b) add a second factor of authentication that would protect the password even in case of a leak.

"One more point that we should add – if someone is re-using their Twitter password also for other online services and accounts, it is highly recommended they change it everywhere. Ideally to a passphrase that has at least 16 characters and is unique for the given account."