W Social privacy practices face scrutiny after a journalist identified publicly accessible records containing users’ identity details. The European alternative to X denies suffering a data breach and says users chose which information to share.
The findings reportedly included nationality information for more than 2,500 users and full names for almost 2,000. In a small number of cases, email addresses also appeared publicly.
However, W Social says nobody accessed or published personal information without authorization. Its October 14 statement attributes the visible records to its verification system and the public protocol supporting the platform.
Public Verification Records Spark Questions
W Social opened its public beta in June 2026, promoting privacy and identity verification as central features. The platform requires real-user verification to reduce bot activity.
According to figures from June, it had approximately 55,000 users. The reported findings do not establish that all those users had identifying information exposed.
Following the discovery, climate-focused platform We Don’t Have Time launched a checker called “Have you been Wned?” It allows users to examine what personal information appears publicly in connection with their accounts.
Meanwhile, W Social says it reviewed the matter with its Data Protection Officer and documented the assessment. The company maintains that the situation does not constitute a personal data breach under GDPR.
W Social Explains Its Use of the AT Protocol
The platform runs on the AT Protocol, which Bluesky Social PBC developed.
When someone verifies an account, W Social says it publishes a verification record through its moderation account. That record allows others to confirm that an account belongs to a verified human.
According to the company, the record includes verification status and the country that issued the user’s passport. It also contains a synthetic birth date used to determine an age range.
Additionally, the record includes a legal name when the user chooses to share it.
W Social argues that these records are public by design. Nevertheless, researchers question whether its handling of user-provided information adequately prevents unintended disclosures.
Researchers Challenge Controls Over Published Information
Security researchers say the accessible records can contain names, nationality details, approximate birth information and, in some instances, email addresses.
However, they also found that most records lacked directly identifying details. Those entries primarily contained identifiers and timestamps showing account creation or verification.
Researchers raised concerns about information appearing in unexpected fields. For example, a person could enter an address into a surname field, potentially causing the system to publish it.
They also warned that removing mistakenly published information can become difficult within a decentralized system.
These observations raise questions about validation and publication controls. However, they do not establish that attackers bypassed the verification system or accessed private identity documents.
W Social Privacy Debate Highlights Phishing Risks
Public identity details can help criminals make fraudulent messages more convincing.
For example, attackers could tailor phishing attempts using someone’s name, nationality or approximate age. They could also combine those details with information obtained from unrelated breaches.
Furthermore, some services use personal background information during account-recovery checks. Researchers warn that accessible identity details could make impersonation easier in those situations.
The concern therefore extends beyond any single field. Combining several pieces of information may reveal more about a person than each record does individually.
Company Says Passport Images and Selfies Remain Private
W Social’s verification process uses a companion app called W Identity. Users provide identity evidence, such as a passport or selfie, through that process.
The company says the app stores data on the user’s device. It also says it deletes documents from its servers immediately after verification finishes.
In its latest statement, W Social emphasized that public records contain no passport images, passport numbers, selfies or real birth dates.
It also denied publishing email addresses through verification records or its Personal Data Server repositories. According to the company, an email address appears only when someone uses it as a handle or display name.
The dispute centers on what users knowingly agreed to publish and whether the platform adequately controls those disclosures. W Social maintains that sharing was voluntary, while researchers continue to question the privacy implications of its public verification records.
0 responses to “W Social Denies Data Leak After Public Identity Records Raise Privacy Concerns”