What was exposed, when it happened, and which databases confirm it.
- accounts
- 5,353,390
- Breached
- January 24, 2023
- Last Update
- August 23, 2023
Were you caught in this breach?
Search your email, phone number or username against every record CheckLeaked indexes.
What happened
In August 2023, 2.6M records of data scraped from Duolingo were broadly distributed on a popular hacking forum. Obtained by enumerating a vulnerable API, the data had earlier appeared for sale in January 2023 and contained email addresses, names, the languages being learned, XP (experience points), and other data related to learning progress on Duolingo. Whilst some of the data attributes are intentionally public, the ability to map private email addresses to them presents an ongoing risk to user privacy.
Compromised Info
- Email addresses
- Names
- Spoken languages
- Usernames
Attestation
Four independent databases catalog this breach and they do not always agree. Each lane below is one source’s own count.
Sources & Link Methods
- LeakCheck— linked via automatic string matching
- Dehashed— linked via domain matching
- HIBP
FAQ
What was leaked in the Duolingo breach?
The Duolingo breach exposed: Email addresses, Names, Spoken languages, and Usernames.
When did the Duolingo breach happen?
The Duolingo breach was disclosed on January 24, 2023 and affected 2,676,696 records.
Am I affected by the Duolingo breach?
Search your email, phone or username at checkleaked.cc to find out whether your data appears in the Duolingo leak.