Duolingo
Disclosed Jan 24, 20233 years ago2,676,696 accountsUnverified
Scraped profile data of 2.6 million Duolingo users sold then leaked
Data scraped from Duolingo's public profiles through an exposed API, including email addresses and names, was offered for sale in January 2023 and published on a hacking forum in August 2023. Duolingo said the data came from public profile information; about 2.6 million records were claimed.
What is known
| People affected | 2,676,696 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Jan 24, 2023 |
| Happened | Jan 24, 2023 |
| Attack | Scraping |
| Data exposed | Emails, Names, Dates of birth, Other |
| Sector | Education · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: Duolingohaveibeenpwned.com · Aggregator | Aggregator |
| Scraped data of 2.6 million Duolingo users released on hacking forumbleepingcomputer.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jan 24, 2023 | |
| Have I Been Pwnedaccounts in the data | Aug 23, 2023 | 2,676,696 |
History of this record
- 2026-09-25 · source_type: aggregator to press · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/Duolingo to https://www.bleepingcomputer.com/news/security/scraped-data-of-26-million-duolingo-users-released-on-hacking-forum/ · seed source
- 2026-09-25 · country: empty to US · seed source
- 2026-09-25 · sector: tech to education · seed source
- 2026-09-25 · data_types: ["emails","names","dob"] to ["emails","names","dob","other"] · seed source
- 2026-09-25 · disclosed: 2023-08-23 to 2023-01-24 · seed source
- 2026-09-25 · summary: In August 2023, 2.6M records of data scraped from Duolingo were broadly distributed on a popular hacking forum . Obtained by enumerating a vulnerable API, the data had earlier appeared for sale in January 2023 and contained email addresses, to Data scraped from Duolingo's public profiles through an exposed API, including email addresses and names, was offered for sale in January 2023 and published on a hacking forum in August 2023. Duolingo said the data came from public profile · seed source
- 2026-09-25 · title: empty to Scraped profile data of 2.6 million Duolingo users sold then leaked · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.