Clubhouse denies data breach allegations

Social audio app Clubhouse put to rest rumours claiming a data breach which made available millions of Clubhouse users' mobile numbers for sale on the Dark Web, stating that no such data breach has occurred, reported IANS on July 25.

Clubhouse spokesperson told IANS that "There are a series of bots generating billions of random phone numbers. In the event that one of these random numbers happens to exist on our platform due to mathematical coincidence, Clubhouse's API returns no user identifiable information."

The news of Clubhouse's alleged data breach broke on July 24 after Twitter users posted screenshots of the 'secret database' of the app listed for sale on the Dark Web. The database claimed to contain 3.8 billion phone numbers, which would be sold to 'one serious buyer' through a 'private auction to be held on the 4th of September'.

Twitter user March Ruef wrote "These (phone numbers) are not just members but also people in contact lists that were synced. Chances are high that you are listed even if you haven't had a Clubhouse login."

However, other Twitter users familiar with the Dark Web refuted the claim. Twitter user Sunny Nehra called the whole ordeal a scam conducted by the 'threat actor'— the user that uploaded the database, tweeting that: "His (the threat actor's) sample is just random Japanese phone numbers with no other personal info. Anyone can post a random list of numbers like that (in fact use some no. generating script). This has always been common on such shady forums."

Rajshekhar Rajaharia, an independent security researcher, confirmed that the data leak appears to be fake. He told IANS that "No names, photos or any other details are available. This list of phone numbers can be generated very easily. The data leak claim appears fake."

The clubhouse has been the recipient of similar allegations in the past. In February, Stanford University warned that the app is leaking audio data to the Chinese government after the Stanford Internet Observatory (SIO) made claims that a Shanghai-based provider Agora supplies Clubhouse with back-end infrastructure.