Clubhouse: Allegedly 3.8 billion phone numbers copied from the system

An offer for sale on the Darknet is causing a stir: A person calling himself God is offering a file with 3.8 billion phone numbers that are supposed to come from a database of the app Clubhouse. The authenticity is in doubt.

3.8 billion phone numbers are for sale

The phone numbers are said to be those of all users of the app, as well as all contacts stored in their address books. According to God, the numbers come from a database that is updated in real time as users of the app add contacts to their address books – so by the time of the announced auction on September 4, the list could grow.

In fact, it is known that Clubhouse, like various other apps, accesses the address books of all users, and thus can also extract the phone numbers and any other associated data of people who are not themselves represented in the app. God is sharply critical of this method: he or she sees this as a violation of the right to privacy and points to the DSGVO, which must take effect in this case – which, God’s advertisement ends, raises the question of whether there will be any punishment as a result of the leak.

Doubts about authenticity of data

However, there are doubts about the authenticity of the data on offer, based both on the sample file uploaded by God himself, containing some 83 million numbers from Japan, which should provide some insight, and on a statement from Clubhouse. The phone numbers from God’s sample file are numbers that could possibly come from Clubhouse; however, this is not provable, since no further information is included besides the phone numbers – neither the assigned names nor any links beyond that. Theoretically, the list could therefore also consist of arbitrarily compiled sequences of numbers or of telephone numbers that originate from publicly accessible sources.

Clubhouse itself, however, denies a leak: In a statement of the company it literally says “There was no data leak at Clubhouse”. The company also points out that data protection and security are “of the utmost importance” to it. This, too, can be doubted, however, as there have already been massive data protection problems in the past. For example, a leak had already occurred in which the real and profile names, links to Twitter and Instagram accounts, the date of account creation at Clubhouse, the number of followers and photo URLs of 1.3 million users of the app appeared in a forum.

More information about the current incident will probably be available by September 4 at the latest, when God plans to sell the data to the highest bidder.