Risk Management, Data Security, Architecture, Application Security, Strategy, Threat intelligence

Clubhouse data leak: 1.3 million scraped user records online for free

April 10, 2021
A SQL database containing 1.3 million scraped Clubhouse user records has been leaked on a popular hacker forum for free, CyberNews reports. The leaked database contains Clubhouse user-related information, including name, user ID, photo URL, username, Instagram and Twitter handle, number of followers and the people they follow, invited by user profile name and account creation date. The company’s April 11 statement on Twitter denied that it has been hacked or breached, and noted that the “data referred to is all public profile information from our app, which anyone can access via the app or our API.” Mantas Sasnauskas, a senior information security researcher for CyberNews, said that the Clubhouse app’s design “lets anyone with a token, or via an API, to query the entire body of public Clubhouse user profile information, and it seems that token does not expire.” He added that Clubhouse should make an extra effort to inform the public about its privacy policy on data scraping and mining. “This should not only be reflected in the ToS, but also in the technical implementation of the app, making it harder for anyone to scrape user data. Having no anti-scraping measures in place can be seen as a privacy issue.”
Jill Aitoro

SC Media Editor in Chief Jill Aitoro has 20 years of experience editing and reporting on technology, business and policy. She also serves as editorial director at SC Media’s parent company, CyberRisk Alliance. Prior to joining CRA, she worked at Sightline Media as editor of Defense News and executive editor of the Business-to-Government Group. She previously worked at Washington Business Journal and Nextgov, covering federal technology, contracting and policy, as well as CMP Media’s VARBusiness and CRN and Penton Media’s iSeries News.

prestitial ad