Duolingo duolingo.com Duolingo data breach: what happened and what to do
In 2023, a scraped set of about 2.6 million Duolingo user records was released online. Have I Been Pwned counts 2,676,696 accounts with email addresses, names, usernames and spoken languages. Duolingo says it was scraped public data, not a hack.
View all 13,115 breaches- Breach date
- 24 Jan 2023
- Made public
- 23 Aug 2023
- Affected
- 2,676,696
- Data exposed
- Email addresses, Names, Spoken languages, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Duolingo is a language-learning app with hundreds of millions of users. Have I Been Pwned (HIBP) lists a Duolingo data set dated January 24, 2023, and added it to its database on August 23, 2023.
What happened
In January 2023 a seller offered Duolingo user records for sale. In August 2023 the set of about 2.6 million records was released for a few dollars' worth of site credits. The records had been collected through an API (a way for programs to query a service) that returns a user's public profile when you submit a username. Researchers had documented how to use it since at least March 2023.
Duolingo said no data breach or hack had occurred and described the incident as a scrape of public profile data. The reports disagree with that framing on one point: the set also included email addresses, which aren't public. HIBP's copy holds 2,676,696 accounts, and that's the number used here.
What was exposed
HIBP lists these data types:
- Email addresses
- Names
- Usernames
- Spoken languages
Reports describe the records as a mix of public details, such as names and login names, with private email addresses attached. Passwords weren't part of it.
What criminals can do with it
A real name, an email and a username make a good phishing template. The message can say it's from Duolingo, refer to your language course and sound routine. The username also links the account to your other profiles, since people often reuse usernames across sites.
Without passwords, criminals can't just log in. But they can use your email to attempt password resets or to try leaked passwords from other breaches against your Duolingo account and others.
Duolingo's response
Duolingo disputed that this was a breach, saying the data was public profile information. Reporting noted that the API was still openly available after a report to the company in January. The sources used here don't describe a settlement.
Scraped data still counts
Scraping is a quieter kind of leak. Nobody broke in, but your email address ends up bundled with your name in a file other people can search. That's the same pattern data brokers use to build profiles.
Serus can't remove breach data from files that are already copied. It monitors breach databases and the dark web for your email and other details, and alerts you when they appear. The steps below cover what's worth doing.
How to check your own exposure
Search your email address on Have I Been Pwned, which is free and doesn't ask for a password. Try any older or secondary addresses too, since people forget the ones they used years ago.
What to do if you were in it
- 1
Expect phishing that mentions Duolingo
Messages about streaks, subscriptions or account problems are an easy disguise. Open the app or type duolingo.com yourself instead of clicking a link.
- 2
Use a unique password for Duolingo
Passwords weren't exposed, but credential stuffing uses passwords leaked elsewhere. A different password per site, saved in a password manager, stops that.
- 3
Turn on two-factor authentication where offered
Do it at least on your email account, since attackers use it to reset other accounts.
- 4
Review your public profile
Check what your Duolingo profile shows, and use a username that doesn't match your other accounts if you want to keep them separate.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures without searching for them.
Frequently asked
Was I affected by the Duolingo breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 2,676,696 accounts.
What was exposed?
Email addresses, names, usernames and spoken languages, according to HIBP. Passwords weren't included.
Was Duolingo hacked?
Duolingo said no hack occurred and that the data was scraped from a public profile API. Reports note the scraped records also included private email addresses.
Is there a settlement?
None of the sources used for this page report a settlement.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
