Duolingo Data Breach: Was Scraped Data Sold?

Yes—data associated with Duolingo users was advertised on a hacking forum after being collected through the company’s publicly accessible API, but the reported incident was scraping, not evidence that attackers broke into Duolingo’s internal systems. The exposed information was described as profile and contact data; claims that passwords or learning records were stolen should not be treated as established facts.

What happened

Reports in early 2023 said a seller offered a dataset associated with roughly 2.6 million Duolingo accounts on a cybercrime forum. The seller reportedly asked for a small payment, and the advertised material included information such as names, usernames, language-learning details, and email addresses. The precise contents and completeness of a dataset offered by a forum seller are difficult to verify independently, so a listing is not proof that every claimed field was present or that every account was affected.

Duolingo said the information had been gathered from publicly available profile data using its application programming interface, or API. An API lets software services exchange information. In this case, reporting described a way to query profile information using email addresses, which could expose whether an address was associated with a public account and return related profile details. The company characterized the activity as scraping rather than a breach of its private databases.

That distinction describes how access occurred; it does not make the privacy concern insignificant. Information that is technically viewable through a public-facing feature can be collected in bulk, linked to other data, and redistributed in ways that individual users did not expect.

Scraping versus a system intrusion

A conventional data breach often involves unauthorized access to protected systems or databases. Scraping usually means automated collection of information that a website or service makes available to users or to software through an interface. Scrapers can send many requests and compile a much larger dataset than a person could gather manually.

The Duolingo incident was reported as API scraping. That means the central concern was the scale and use of data exposed through a feature, rather than confirmed theft of encrypted passwords from an internal account database. Calling it “not a breach” in the narrow technical sense does not mean nothing happened: mass collection can still create meaningful risks, especially if contact details can be connected to identifiable profiles.

• Scraping: automated collection of accessible information, sometimes in violation of a service’s rules.
• Credential theft: obtaining passwords or login tokens; this was not established by the reported Duolingo scraping incident.
• Account takeover: using stolen credentials or other methods to enter accounts; the reported dataset alone does not show that accounts were accessed.

What information was reportedly exposed

News coverage of the forum listing described personal profile information and email addresses, with details such as a user’s name, username, and language-learning information among the reported fields. Public profile details can be sensitive in context: a username may be reused elsewhere, and a learning profile can reveal personal interests or activity. An email address also makes a person easier to target with tailored messages.

There is an important limit to what can be concluded. Forum advertisements are not reliable audits, and public reporting did not establish that the seller had passwords, payment-card details, private messages, or complete lesson histories. Do not assume those categories were part of the scraped dataset unless a trustworthy, specific source confirms them. Nor does the reported scale prove that every Duolingo user, or every user whose email was queried, was included.

Why scraped data can still be risky

The main practical risk is often follow-on targeting rather than direct login. A scammer who knows someone uses Duolingo, recognizes a username, or has an email address can write a more convincing phishing message. It might claim there is a problem with a language-learning account, imitate a security alert, or try to persuade the recipient to open a link or reveal a password.

Scraped information can also be combined with other datasets. For example, an email address from one source might be matched to a username or public profile from another. That kind of linkage can make a message seem personal even when the sender has no access to the account itself. The existence of such possibilities does not show that a particular user was targeted or harmed.

Keep these distinctions in mind:

• An exposed email address does not, by itself, give someone access to the mailbox.
• A public profile detail is not the same as a password or authentication token.
• A password reset message is not evidence that an account has been compromised; check it through the service’s app or website rather than following an unexpected link.

What Duolingo users can do

If you have a Duolingo account, you do not need to panic or assume it was taken over. Sensible account hygiene can reduce the impact of exposed contact information, whether or not your particular profile was in the dataset:

1. Use a unique password. If you reused your Duolingo password on another service, change it on those other services too. A password manager can help create and store different passwords.
2. Secure the email account tied to Duolingo. Your email account can be used to reset passwords, so protect it with a unique password and available sign-in protections such as multifactor authentication.
3. Be cautious with messages. Do not click unexpected account or “data leak” links. Open the official app or type the service’s address yourself to check an alert.
4. Review account settings and profile visibility. Remove details you do not want displayed publicly, where the service offers controls. Avoid reusing a distinctive username across unrelated services.
5. Watch for signs of actual account access. Unexpected password-reset notices, changed account details, or activity you did not perform deserve attention. Change the password through the official service and follow its account-recovery guidance.

These steps are useful precautions, not proof that a particular account was included. If you receive a message claiming to identify you as a victim, treat the message itself cautiously: scammers may exploit public news about a data incident.

How to interpret the reports

“Scraped data on a hacking forum” combines two separate claims: that information was collected at scale and that it was offered in a criminal online venue. The reporting supports the broad description of a dataset associated with Duolingo users being advertised after API scraping. It does not establish every detail a seller might have claimed, nor does the forum listing alone establish a company-wide intrusion.

When reading similar incident coverage, look for whether a company confirms the collection method, which data fields are actually documented, how many accounts are affected, and whether there is evidence of unauthorized logins. Those are different questions. A story can accurately report that data was listed for sale while still leaving uncertainty about its exact contents, provenance, and practical impact.

Frequently Asked Questions

Was Duolingo hacked?
Reporting described automated collection of profile information through a publicly accessible API, not a confirmed intrusion into Duolingo’s internal systems. “Scraping incident” is the more precise description of what was reported.

Were Duolingo passwords leaked?
Passwords were not established as part of the reported scraped dataset. The information described publicly included profile and contact details; avoid treating unverified forum claims as proof of password theft.

How many users were affected?
Reports associated the forum listing with about 2.6 million accounts. That is the reported dataset scale, not confirmation that every listed record was valid or that all Duolingo users were affected.

Should I change my Duolingo password?
If it is reused anywhere else, change it on every service where it is reused and choose unique passwords. Even without confirmed password exposure, unique credentials limit the damage if another service’s data is compromised.

Can I tell whether my email was in the dataset?
Public reporting does not provide a dependable way to confirm every affected address. Be wary of websites or messages that ask for your email or password to “check” a breach; use trusted breach-notification services and never enter your account password into a checker.

Related

• Gym Star Simulator Codes: Current Status and Help
• Best Smart Wallets: Trackers, Slim Picks, and Trade-Offs
• Meta Muse Data Collection and How It Is Used