Clubhouse Data Breach Exposes 1,300,499 User Profile Records

HEROIC analysts identified a Clubhouse database dated 11-Apr-2021 containing 1,300,499 user records. The file lists usernames, first and last names, and linked social media details for Clubhouse accounts. No passwords or contact details appear in this particular file, but the profile information alone is enough to build a convincing picture of real people. If you ever created a Clubhouse account, it is worth taking a minute to scan your email and see where your information has turned up.

How Someone Could Use a Scraped Clubhouse Profile

A file like this gives an attacker a verified list of real names tied to real usernames and social accounts. That combination is useful for building fake profiles, researching a specific target before a scam, or linking a person's activity across platforms they thought were separate.

The Profile Details Found in This Clubhouse File

• Username
• First name
• Last name
• Social media

What This Exposure Could Mean for Clubhouse Users

Attackers can use a full name paired with a username and social handle to impersonate someone, send convincing friend or follow requests, or craft a phishing message that references details only a real contact would know. Combined with other leaked data from different sources, this kind of profile data makes identity based scams easier to pull off.

How Large Scale Profile Scraping Happens

This type of exposure usually happens when an automated script is pointed at a platform's public profile pages or an exposed part of its interface, pulling data field by field across millions of accounts. Because the information is technically public, the collection can run for a long time before anyone notices, and the result is often packaged and shared as a single file like this one.

Check Your Email for Exposure Right Away

If you have ever used Clubhouse, it is worth checking whether your account details are part of this file. Scan your email to see if your information appears in this or other exposures. Do this for both your personal and any work email you may have used to sign up, since either one could be included.