Hackers Stole Emails and Names from 2.6M Duolingo Users

Hackers stole email addresses, usernames, first names, and last names from 2,676,692 Duolingo users after exploiting a vulnerable API in January 2023. The breached data was initially offered for sale and then broadly disseminated on a popular hacking forum in August 2023, where it became accessable to a wide range of threat actors. This incident demonstrates how a single API vulnerability can result in the exposure of millions of recieved records across multiple criminal marketplaces.

Why Exposed Usernames and Emails Are a Privacy Risk

While Duolingo usernames and learning activity are partially public, the combination of that data with private email addresses creates a powerful targeting tool for phishing campaigns. Attackers can craft personalized messages referencing a user's learning habits, making deceptive emails far more convincing. This type of contextual phishing is partcularly effective because the content feels familiar and legitimate to the recipient.

What Was Exposed in the Duolingo Breach

• Email Address
• Username
• First Name
• Last Name

Why the Duolingo Breach Still Matters Today

Data from large-scale breaches like this one continues to be traded, merged with other datasets, and used in credential stuffing operations for years after the initial leak. Even without passwords, the combination of names and verified email addresses is valuable to spam operators and social engineers. Duolingo users remain at heightened phishing risk as long as this data continues to circulate online.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a company's stored data, often through exploited vulnerabilities such as insecure APIs, weak credentials, or misconfigured systems. Once inside, the attacker can extract large volumes of user records in a matter of minutes. The stolen data is then sold or published on hacker forums where it reaches a wide criminal audience.

Check If Your Data Was Exposed

HEROIC monitors over 400 billion breached records, including the Duolingo dataset, so you can quickly find out if your email was part of this or any other known incident. Search your email address now to get a complete exposure report and learn what steps you should take to protect yourself.