Wow, that really is a ton of egg on Twitter's face.

The revelation from Techcrunch's Michael Arrington that at least 300 highly confidential, internal Twitter documents had been stolen by a hacker and sent to his inbox should have been a shocking one. Unfortunately for the microblogging platform, it wasn't - Twitter is on its way to becoming synonymous with "terrible security," in particular on the part of its administrators and back-end staff. Back in May, the social network's admin panel was compromised by a hacking known as "Croll Hacker," who claimed that he was able to hack one of Twitter's admin accounts by guessing the password - which was, simply, "happiness."

Now, that same hacker is claiming to have successfully "hacked" Twitter accounts, Gmail accounts, and dozens of other network logins and passwords belonging to Twitter employees and even co-founder Evan Williams and his wife. He claims to have collected hundreds of pages of confidential documents, including information on Twitter's business plan (world-shattering shock: they're gonna make money though account verification and Google AdSense), their projections for the coming years (25 million users by EOY 2009, 100 million by EOY 2010, and 350 million users by EOY 2011), lists of interviewees (potentially very damaging for people who're interviewing at Twitter while still working for their current jobs)...the list of sensitive information the hacker claims is in the document package is staggering.

According to a post on a French website, Korben.Info, the hacker didn't use brute-force password cracking, keylogging or any other "technical" hacks; he simply used the password recovery features of popular websites like Gmail, Amazon, and MobileMe.

From a translation of that original French post:

All of which begs the question, What the hell is going on with Twitter's security? It should be a no-brainer that a service as massive as Twitter is going to be the target of fairly complex attacks, both technical (hacks) and non-technical (social engineering). It's likely that the latter played a significant role in the hacks, since Hacker Croll himself hasn't displayed any particularly extensive knowledge of hacking or password-cracking; rather, it's more likely that he's an extremely clever individual with a solid understanding of social engineering and how easy it can be to get someone to give up their password if you ask the right questions.

Korben.info offered what is allegedly a quote from Hacker Croll himself on the topic:

Meanwhile, Evan Williams confirmed to Michael Arrington at TechCrunch that some password-cracking had occurred, confirming that his wife's Gmail Account had been hacked, as well as several others, but stopping short of confirming that the hacker in question had, indeed, compromised as many accounts as he claimed. From Williams' email to Arrington:

The Twitter co-founder went on to express distress at the compromise of security.

"Distress" is exactly what we're feeling right now, looking at how weak security seems to be on Twitter's back-end. At a company of that size, of that importance, every single employee from the CEO to the janitor should be intimately familiar with social engineering techniques, should use incredibly secure passwords (12+ digits, upper- and lower-case mixed, numbers and special characters), and should use complex answers to "password recovery" questions. "What is your wife's maiden name" might cut it for me, who nobody knows, but in the case of a person like Evan Williams, information like that is simply too easy to come by; other solutions must be reached (such as encrypting password recovery questions with a cypher, for example).

It was embarrassing last May when Hacker Croll was able to guess one of Twitter's admin passwords. That was the point when Twitter should have woken up and taken whiplash fast steps to strengthen their security, starting all the way at the top of the food chain and ending all the way at the bottom. How many more high-profile security breakdowns is Twitter going to have before they wake up and smell the coffee?

We'll be covering the details on this information leak as we get them in the coming days; we're expecting several high-profile news sites (as well as the ubiquitous Wikileaks to release some of the documents publicly within the next few days.