They explained the bug here:

> May 3, 2018

> Due to a bug, passwords were written to an internal log before completing

> the hashing process. We found this error ourselves, removed the passwords,

> and are implementing plans to prevent this bug from happening again.

> — https://blog.twitter.com/official/en_us/topics/company/2018/...

It's very unlikely they store their passwords in plaintext. They were probably logging during login requests and didn't realize the whole request body was being logged. Can happen if you have a proxy/load balancer with logging enabled.

That's almost certainly a case where POST parameters get logshipped to some server for debugging purposes, and it's easy to miss something like that in an audit when you're dealing with terabytes of logfiles.

Even if the logfiles are rotated every day you don't know if a developer has seen somebody's password during that window, so all passwords are assumed to be compromised.

I don't think they were storing them in plain text, but on a login request it would log the request body without properly censoring the password. The password could still be hashed when it was actually put into the database.