The scraped data of 2.6 million DuoLingo users was leaked on a hacking forum, allowing threat actors to conduct targeted phishing attacks using the exposed information.
Duolingo is one of the largest language learning sites in the world, with over 74 million monthly users worldwide.
In January 2023, someone was selling the scraped data of 2.6 million DuoLingo users on the now-shutdown Breached hacking forum for $1,500.
This data includes a mixture of public login and real names, and non-public information, including email addresses and internal information related to the DuoLingo service.
While the real name and login name are publicly available as part of a user's Duolingo profile, the email addresses are more concerning as they allow this public data to be used in attacks.
When the data was for sale, DuoLingo confirmed to
TheRecord that it was scraped from public profile information and that they were investigating whether further precautions should be taken.
When the data was for sale, DuoLingo confirmed to
TheRecord that it was scraped from public profile information and that they were investigating whether further precautions should be taken.
However, Duolingo did not address the fact that email addresses were also listed in the data,
which is not public information.
