Clubhouse data leak: 1.3 million scraped user records online for free

A SQL database containing 1.3 million scraped Clubhouse user records has been leaked on a popular hacker forum for free, CyberNews reports. The leaked database contains Clubhouse user-related information, including name, user ID, photo URL, username, Instagram and Twitter handle, number of followers and the people they follow, invited by user profile name and account creation date. The company’s April 11 statement on Twitter denied that it has been hacked or breached, and noted that the “data referred to is all public profile information from our app, which anyone can access via the app or our API.” Mantas Sasnauskas, a senior information security researcher for CyberNews, said that the Clubhouse app’s design “lets anyone with a token, or via an API, to query the entire body of public Clubhouse user profile information, and it seems that token does not expire.” He added that Clubhouse should make an extra effort to inform the public about its privacy policy on data scraping and mining. “This should not only be reflected in the ToS, but also in the technical implementation of the app, making it harder for anyone to scrape user data. Having no anti-scraping measures in place can be seen as a privacy issue.”