Duolingo
duolingo.com
About This Breach
Data belonging to 2.6 million Duolingo users was scraped in January 2023. This data included real names, login names, email addresses, and internal DuoLingo service information. The leak stemmed from an exposed API that allowed threat actors to confirm email addresses associated with DuoLingo accounts.
Data Exposed
Breach Details
| Breach Type | Data Breach |
| Searchable | Yes |
| Verified | Yes |
| Sensitive Data | No |
| Reference | https://www.bleepingcomputer.com/news/security/scraped-data-of-26-million-duolingo-users-released-on-hacking-forum/ (opens in new tab) |
Frequently Asked Questions
When did the Duolingo data breach happen?
Duolingo was breached in Jan 2023. The breach was added to the XposedOrNot index on November 8, 2023.
How many records were exposed in the Duolingo breach?
2,676,686 records were exposed, making it the #272 largest of the 776 breaches in our index.
What data was exposed in the Duolingo breach?
The exposed data includes: Email addresses, Names, Usernames.
What should I do if I was affected by the Duolingo breach?
Change your password on the affected service (and anywhere you reused it), turn on two-factor authentication, and set up free breach alerts on XposedOrNot so you know the moment your email appears in a new breach.
More Education Breaches
What Should You Do?
Enable Two-Factor Authentication
Add 2FA on all supported accounts using an authenticator app like Google Authenticator or Authy.
Monitor Your Accounts
Set up login alerts and review account activity regularly for suspicious access.