Duolingo
What was exposed
Email addressesNamesSpoken languagesUsernames
What to do if you were affected
- Expect more phishing and spam at this address. Treat messages that reference this company with extra caution.
- Be wary of targeted scams that use your personal details to sound convincing.
Details
In August 2023, 2.6M records of data scraped from Duolingo were broadly distributed on a popular hacking forum . Obtained by enumerating a vulnerable API, the data had earlier appeared for sale in January 2023 and contained email addresses, names, the languages being learned, XP (experience points), and other data related to learning progress on Duolingo. Whilst some of the data attributes are intentionally public, the ability to map private email addresses to them presents an ongoing risk to user privacy.
Frequently asked questions
What is the Duolingo data breach?
In August 2023, 2.6M records of data scraped from Duolingo were broadly distributed on a popular hacking forum . Obtained by enumerating a vulnerable API, the data had earlier appeared for sale in January 2023 and contained email addresses, names, the...
When did the data breach happen?
This data breach occurred around January 2023.
How many accounts were affected?
Around 2,676,696 accounts were affected.
What information was exposed?
Exposed data included Email addresses, Names, Spoken languages and Usernames.
What should I do if I was affected?
Expect more phishing and spam at this address. Treat messages that reference this company with extra caution. Be wary of targeted scams that use your personal details to sound convincing.
Related breaches