Duolingo Data Breach (2023)

On January 24, 2023, Duolingo appeared in a breach notification published by Have I Been Pwned, confirming that 2.6 million records scraped from the language-learning platform had been circulating among threat actors since at least that date. The data, obtained through enumeration of a vulnerable API, was later broadly distributed on a popular hacking forum in August 2023. Anyone who used Duolingo around that period may have had their email address, name, username, spoken languages, and learning-progress details exposed.

Reported Details from the Disclosure

The primary listing on Have I Been Pwned states that the dataset contains email addresses, names, usernames, spoken languages, and information tied to learning progress such as experience points. The breach notification does not indicate that passwords were taken. The records were first offered for sale in January 2023 before appearing in open distribution months later. Duolingo has not published its own detailed public notification quantifying exactly which accounts were affected or the precise technical root cause beyond the vulnerable API enumeration.

Some of the learning-related fields were already visible on public profiles, yet the linkage to private email addresses creates new exposure that did not exist before the scrape.

Why This Matters for You and Your Family

If you or anyone in your household uses Duolingo, your real name and email address are now permanently linked to your language-learning habits and username. This information can be used to profile you, target phishing campaigns that reference your progress in Spanish or French, or serve as a reliable data point in larger identity profiles sold on underground markets. Children and teenagers who practice languages on the app are also at risk; their usernames and progress data can be tied back to family email addresses, giving attackers an easy way to map household relationships.

2.6 million records is a significant volume, and the persistent availability of the dataset means the exposure is unlikely to fade quickly.

Doxxing and Identity-Chain Risks

The real danger lies in how this breach chains with others. An email address tied to a Duolingo username and spoken languages becomes a pivot point for attackers to locate your accounts on other platforms. Once they control one gaming or social account, they can reset additional services, request personal data from customer-support teams, or publish your information for harassment. Credential leaks of this nature frequently cascade into full doxxing chains, especially when usernames are reused across gaming services popular with children and teens.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including cleanup of exposed data.
• Rotate the password used on Duolingo anywhere it is reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children's gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf.

The incident underscores that even platforms focused on education can become persistent sources of identity linkage once an API scrape escapes into the wild. Starting proactive defense now limits how far attackers can travel down the identity chain created by this and future leaks. DoxxScan provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly includes children's gaming accounts.