September 1, 2023
An exposed application programming interface (API) at Duolingo allowed threat actors to scrape the personal information of 2.6 million users, including email addresses, phone numbers, and usernames. The data was then leaked on an underground hacking forum.
Duolingo said that its systems were not compromised in the breach, but that the data was scraped from publicly available profile information. However, researchers have found that the API also allowed threat actors to obtain private user information, such as email addresses.
Duolingo has since fixed the exposed API. While Max Gannon, a Senior Cyber Threat Intelligence Analyst, suggests that while the data may seem low in value, it could be leveraged for highly targeted attacks.
On March 2, a researcher named Ivano Somaini tweeted about using Duolingo’s API to check if an email is linked to a Duolingo account. This API lets users verify if a username or email is associated with a Duolingo account. It’s still accessible online, despite being reported for misuse in January.
It shows how often the user uses Duolingo, a URL for the profile picture, learning languages, XP points, and crowns as well as l courses, progress, and XP points. It goes ahead to indicate if the profile is linked to Facebook or Google coupled with the Duolingo’s user ID, account’s username and phone number.
The sources for this piece include an article in CPOMAGAZINE.
