Duden

We've been tracking a steady increase in German-language data appearing on traditionally English-dominated breach forums, a trend suggesting a growing focus on German-speaking targets or a shift in the actors involved in initial access. Our team initially flagged this new activity while monitoring a relatively obscure Telegram channel known for aggregating leaked databases. What made this particular data dump stand out wasn't its size, but its source: a comprehensive scrape of the popular German online dictionary, **Duden**. The exposed data, while not containing passwords, presents a significant risk due to the insights it offers into user behavior, search patterns, and potential for targeted phishing campaigns.

### Duden User Data Scraped and Leaked: Insights into Language and Search Habits Exposed

The breach involves a large-scale scraping of user data from **Duden**, a widely used online dictionary and grammar resource in Germany. The data was discovered on **March 8, 2024**, on a Telegram channel known for hosting aggregated breach data. It quickly caught our attention due to the comprehensive nature of the scrape and the potential for leveraging the data for social engineering attacks. While the data doesn't include passwords, the exposed search queries, user IDs, and other metadata provide valuable insights into user interests and language patterns, which can be exploited in targeted phishing campaigns or to personalize malware attacks. This incident highlights the growing risk of data scraping, even when seemingly innocuous data is involved. This also underscores the value of even metadata to malicious actors.

**Breach Stats:**

* **Total records exposed:** Approximately **2.4 million** user records.
* **Types of data included:** User IDs, search queries, timestamps, device types, operating systems, and IP addresses.
* **Sensitive content types:** Search queries themselves may contain sensitive information depending on the user's search habits and interests.
* **Source structure:** JSON dump.
* **Leak location:** Telegram channel.

### External Context & Supporting Evidence

While the Duden data breach itself hasn't received widespread coverage in major news outlets at the time of this writing, the risk of data scraping is a well-documented threat. Security researcher **Troy Hunt**, creator of Have I Been Pwned, has extensively written about the dangers of data scraping and its potential for misuse. Numerous reports from cybersecurity firms highlight the increasing sophistication and scale of web scraping operations, often targeting platforms with large user bases and valuable data. The scraped data can then be used for various malicious purposes, including identity theft, fraud, and targeted advertising. One Telegram post claimed the files were "collected from devs testing an AI project".