The popular language learning platform has come under scrutiny as a post on a hacker’s forum offers access to information from 2.6 million customer accounts for a mere $1,500.
Duolingo is an American educational technology company that produces learning apps and provides language certification.
The hacking forum post, created on a Tuesday morning, caught DuoLingo’s attention as it offered sensitive customer account details, including emails, phone numbers, courses taken, and other usage-related information for a price.
A spokesperson for the company has stated to Record that these records were amassed through data scraping public profile information, emphasizing that no data breach or hack has occurred.
“No data breach or hack has occurred. We take data privacy and security seriously and are continuing to investigate this matter to determine if there’s any further action needed to protect our learners.”
DuoLingo’s team is actively investigating the matter to assess the need for further protective actions to ensure their users’ safety.
Data scraping, or web scraping involves automated data extraction from websites and online platforms.
While scraping of public information is common, it becomes problematic when sensitive and private data is compromised.
In this case, the hacker claimed to have sourced the information by exploiting an exposed Application Programming Interface (API).
The hacker also showcased their illicit achievement by sharing a sample dataset from 1,000 accounts.
The DuoLingo incident highlights a pervasive problem faced by tech companies worldwide.
Numerous tools and techniques are available to scrape APIs, allowing individuals to amass vast amounts of data from websites.
Often, this data is publicly accessible, but there are instances where it becomes accessible through links to other sites, inadvertently putting sensitive information at risk.
Tech giants are also vulnerable to web scraping. Meta (previously Facebook) filed a lawsuit against a surveillance service for generating fake accounts on Instagram and Facebook to scrape user data.
Similarly, in 2021, Facebook sued an individual who scraped the data of over 178 million Facebook users, exploiting the contacts import feature in its Messenger app.
Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.
ChaosBot surfaced in late September 2025 as a sophisticated Rust-based backdoor targeting enterprise networks. Initial…
Threat actors have reemerged in mid-2025 leveraging previously disclosed vulnerabilities in SonicWall SSL VPN appliances…
Menlo Park, USA, October 10th, 2025, CyberNewsWire AccuKnox, a leader in Zero Trust Cloud Native…
Socket's Threat Research Team has uncovered a sophisticated phishing campaign involving 175 malicious npm packages…
Since its emergence in early 2025, RondoDox has rapidly become one of the most pervasive…
Microsoft Defender for Endpoint is incorrectly flagging specific versions of SQL Server as having reached…