Duolingo API Scrape Exposes 2.68 M User Records
What Happened – In August 2023, threat actors enumerated a vulnerable Duolingo API and scraped 2,676,696 user records. The data set, later posted on a hacking forum, contained email addresses, names, usernames, spoken‑language preferences, and learning‑progress metrics (XP).
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous monitoring of API authentication and authorization to prevent unauthorized enumeration.
- Demonstrates why audit‑ready logging of API activity is essential for a defensible evidence trail.
- Aligns with the control objective of secure API management, which can be proven through Verisq’s control‑mapping capability.
Who Is Affected – Education‑technology SaaS providers, language‑learning platforms, and their millions of end‑users.
Recommended Actions
- Review and harden API access controls (enforce least‑privilege, token validation, rate limiting).
- Deploy continuous monitoring and retain detailed logs of all API requests for audit readiness.
- Conduct a control‑mapping exercise against the Verisq Common Framework to verify coverage of API security controls. Source: https://haveibeenpwned.com/api/v3/breach/Duolingo
Technical Notes – Attack vector: exploitation of an improperly secured API endpoint (vulnerability exploit). Exposed data types: email, name, username, language preferences, XP (experience points). No specific CVE was disclosed. Source: https://haveibeenpwned.com/api/v3/breach/Duolingo