2.6 million user accounts leaked in Duolingo data breach

Share post:

An exposed application programming interface (API) at Duolingo allowed threat actors to scrape the personal information of 2.6 million users, including email addresses, phone numbers, and usernames. The data was then leaked on an underground hacking forum.

Duolingo said that its systems were not compromised in the breach, but that the data was scraped from publicly available profile information. However, researchers have found that the API also allowed threat actors to obtain private user information, such as email addresses.

Duolingo has since fixed the exposed API. While Max Gannon, a Senior Cyber Threat Intelligence Analyst, suggests that while the data may seem low in value, it could be leveraged for highly targeted attacks.

On March 2, a researcher named Ivano Somaini tweeted about using Duolingo’s API to check if an email is linked to a Duolingo account. This API lets users verify if a username or email is associated with a Duolingo account. It’s still accessible online, despite being reported for misuse in January.

It shows how often the user uses Duolingo, a URL for the profile picture, learning languages, XP points, and crowns as well as l courses, progress, and XP points. It goes ahead to indicate if the profile is linked to Facebook or Google coupled with the Duolingo’s user ID, account’s username and phone number.

The sources for this piece include an article in CPOMAGAZINE.

Featured Tech Jobs


Related articles

Cyber Security Today, Week in Review for the week ending Friday, Sept. 29, 2023

This episode features discussion on October Security Awareness Month, ransomware, teenage hackers and the start of hearings into proposed Canadian privacy a

Admins urged to quickly patch holes in WS_FTP file transfer server

This is the fourth file transfer application -- and the second from Progress Software -- to recently face critical vulne

Cyber Security Today, Sept. 29, 2023 – Protect your routers from this attacker, new open-source malware packages found, and more

This episode reports on a China-based group that specializes in hacking branch office routers of major

Champagne squeezed to produce proposed amendments on privacy, AI bills

Opposition gives government five business days to produce proposed

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways