The scraped data of 2.6 million DuoLingo users was leaked on a hacking forum, allowing threat actors to conduct targeted phishing attacks using the exposed information.

  • ADTJ@feddit.uk
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    Take this with a pinch of salt but what I’m gathering is that it’s essentially just taking people’s public profiles but the Duolingo api also exposes users’ e-mail addresses (and possibly other info) that isn’t normally displayed as part of the user’s public profile via their app.

    In essence, they’re exposing more data than they probably should be and users were not really aware that data was being made public - that’s why people are upset about it.

    • circuitfarmer@lemmy.sdf.org
      link
      fedilink
      English
      arrow-up
      5
      ·
      1 year ago

      Ok, this makes sense – in which case the API should not be exposing data that isn’t otherwise available on the public profile, so that is significant.