Twitter confirmed Friday that a bad actor used a vulnerability to match private information with potentially anonymous Twitter accounts.