More than 74 million people around the world use Duolingo every month, one of the most popular language-learning apps, and its success is indisputable, but the company’s data management procedures are more than that – sleeping computer According to his article, the hackers gained access to the information of approximately 2.6 million users thanks to what is called data scraping.
The data was posted on a now closed forum in January, asking for $1,500, about 530,000 Hungarian forints.
Bleeping Computer reports that hackers gained access to email addresses, usernames, real names, and other data related to Duolingo services.
According to the newspaper’s information, the data was obtained through an open API available since March 2023, through which almost anyone can query profile data. Although email addresses aren’t public, by entering them into the API, the interface is able to indicate almost instantly whether a given address is associated with a Duolingo account. Of course, they didn’t do all of this at once, because that would have taken too much time – hackers usually work with other batches of leaked addresses as well.
Bleeping Computer confirmed that the API remains openly available to anyone on the web, even after the abuse was reported to Duolingo.
By the way, companies often don’t deal with such and similar data theft attacks, since most of the data that hackers can extract is also publicly available from other places – however, if hackers can tie that to private data, like a phone number, it’s easy to get caught. In problems companies can avoid.
