2023 API scraping — 2.6M users

2023 2.6M records affected

Data compromised

Emails, usernames, names, languages, XP

Technical writeup

Aug 2023. Exposed API allowed attackers to scrape 2.6M Duolingo users by submitting emails from prior breaches. Data sold on Breached forum. Exposed: emails, usernames, names, languages, XP. Duolingo said no systems compromised; implemented rate limits.

Root cause

Exposed API; email-to-account enumeration.

References

https://www.bleepingcomputer.com/news/security/scraped-data-of-26-million-duolingo-users-released-on-hacking-forum/
https://haveibeenpwned.com/Breach/Duolingo