Clubhouse Hacked: 3.8 Billion Contact Records Leaked

The voice chat community “Clubhouse,” which was once as popular as a brilliant summer fireworks explosion and which everyone begged and pleaded to join through connections, has reportedly been hacked according to foreign media reports[1]. In addition to members’ own data, the contents of everyone’s contact lists — totaling over 3.8 billion — may have all been leaked, meaning the personal data of half of humanity may have been exposed, making it arguably the largest data breach in history.

Intelligence from the Dark Web

According to reports, a Darknet member planned to sell the entire Clubhouse database to the highest bidder at a private auction in September. To prove the reliability of the intelligence, the member provided up to 83 million Japanese phone numbers in advance for potential buyers to verify.

Screenshot of the auction invitation (Source: Twitter)

Since Clubhouse initially adopted an invitation-letter verification model, ordinary users had no suspicions and believed this was a normal online usage method. Most would allow the app to freely read their phone contacts and use them to invite friends and family to join the trend of showing off their vanity.

But through this incident, people were shocked to realize that in addition to members’ own personal data, all account information in their phone contacts was also secretly uploaded to Clubhouse’s private database, which accidentally led to the massive Earth-scale data leak of 3.8 billion records after Clubhouse was breached.

Since Clubhouse creates a rating system based on user behavior and popularity, once the leaked data includes these system parameters and identity-identifiable intelligence, hackers only need to simply sort by score to potentially analyze important information ranging from high-level government officials of various countries down to merchants and common people for other uses, or to trade and sell to advertising companies or the data analysis industry.

This leak incident has little impact on ordinary users without fame (after all, the government previously self-exposed that the Ministry of the Interior database of the Republic of China had long been happily visited by hackers). The biggest impact is actually on Clubhouse itself.

How Will the EU Handle Clubhouse?

In the General Data Protection Regulation established by the EU, companies are explicitly prohibited from collecting personal data of individuals who do not use the service. If the leaked data is proven to be authentic, the EU will intervene, with penalties of up to 20 million euros or 4% of sales (whichever is higher), plus possible class-action lawsuits by foreigners. For Clubhouse, which has not yet started making a profit, is cooling down in user popularity, and is surrounded by a large number of external enemies, this is undoubtedly another blow.

Deleting the Clubhouse App

If you now plan to remove Clubhouse, in addition to uninstalling the app on your phone, you can further request the official deletion of your entire account. Please refer to “How to Delete Your Clubhouse Member Account and Remove Data?”[3] for the steps.

References

1. Hacker intrusion, leak of address book
2. Reddit: (Foreign Source) The entire Clubhouse phonenumber database (3.8 billion numbers, including contacts) is up for sale on the darknet
3. How to Delete Your Clubhouse Member Account and Remove Data?