Breachesby GlyphDuolingo
Disclosed Jan 24, 20232,676,696 accountsUnverified
Scraped profile data of 2.6 million Duolingo users sold then leaked
Data scraped from Duolingo's public profiles through an exposed API, including email addresses and names, was offered for sale in January 2023 and published on a hacking forum in August 2023. Duolingo said the data came from public profile information; about 2.6 million records were claimed.
What is known
| People affected | 2,676,696 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Jan 24, 2023 |
| Happened | Jan 24, 2023 |
| Attack | Scraping |
| Data exposed | EmailsNamesDates of birthOther |
| Sector | Education · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
Notices filed
History of this record
aggregator to pressby seedSource
https://haveibeenpwned.com/Breach/Duolingo to https://www.bleepingcomputer.com/news/security/scraped-data-of-26-million-duolingo-users-released-on-hacking-forum/by seedSource
empty to USby seedSource
tech to educationby seedSource
["emails","names","dob"] to ["emails","names","dob","other"]by seedSource
2023-08-23 to 2023-01-24by seedSource
In August 2023, 2.6M records of data scraped from Duolingo were broadly distributed on a popular hacking forum . Obtained by enumerating a vulnerable API, the data had earlier appeared for sale in January 2023 and contained email addresses, to Data scraped from Duolingo's public profiles through an exposed API, including email addresses and names, was offered for sale in January 2023 and published on a hacking forum in August 2023. Duolingo said the data came from public profile by seedSource
empty to Scraped profile data of 2.6 million Duolingo users sold then leakedby seedSource
First recordedby backfillSource
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.