The scraped data of 2.6 million DuoLingo users was leaked on a hacking forum, allowing threat actors to conduct targeted phishing attacks using the exposed information.
That's the thing that annoys me most about Duolingo: if they're going to show you ads, the least they could do is show you ones in the language you're trying to learn instead of your native one.