W Social Denies Data Leak as Public Verification Records Raise Privacy Concerns

W Social denies data breach claims

W Social, a European social media platform that opened to the public in beta in June 2026, has denied leaking personal data to the open web. The company released a statement on October 14, 2026, following findings by German tech journalist Gavin Karlmeier, who revealed a publicly visible database containing W Social accounts. According to Karlmeier, over 2,500 users allegedly had their nationality published online, and almost 2,000 had their full names exposed. In some rare cases, email addresses were also visible.

W Social, which markets itself as a privacy-focused network requiring real user identities to stave off bots, said no personal data has been leaked, accessed without authorization, or inadvertently published. The company consulted its Data Protection Officer and documented the assessment, adding that there has been no personal data breach under the General Data Protection Regulation.

Verification records and the AT Protocol

W Social partly admitted the publication of user data, explaining that it stems from the public nature of the AT Protocol, the underlying technology developed by Bluesky Social PBC, the American company behind Bluesky. When a user verifies an account, W Social writes a verification record to its moderation account on the AT Protocol. The record contains the verification status, the country that issued the user's passport, a synthetic date of birth used to derive an age range, and, only for users who chose to share their legal name, that name.

Karlmeier's findings raised concerns among the platform's roughly 55,000 users, according to data from June. The social media platform We Don't Have Time, focused on climate action, released an online checker called "Have you been Wned?" where users can see how much of their personally identifiable information is public.

Privacy risks and criticism

Aras Nzarovas, a senior information security researcher at Cybernews, said W Social publicly publishes information such as first and last names, email addresses, nationalities, and approximate dates of birth. Most records are anonymous and contain only metadata such as IDs and creation or verification timestamps. While an actual date of birth is sometimes added to a person's last name, it appears to be wrong by approximately six months.

Nzarovas warned that threat actors could misuse the public verification data for doxxing or targeted phishing attacks, personalizing messages based on nationality, age, and name. If platforms use such information as a second layer of identity verification over phone or chat, the leak could lead to simplified account takeovers. He also noted that attackers typically combine data from multiple leaks, so this information could enrich previously leaked data. Removing such data from a decentralized system can be difficult.

Since W Social was announced in early 2026, its verification methods have drawn criticism. Users must upload a passport or biometric data, such as a selfie, to a companion app called W Identity. The company says the app is decentralized, stores data on the user's device, and that documents on W's servers are deleted immediately after verification. Cybernews researchers, however, emphasize that biometric data is highly sensitive and creates a permanent identity record that, unlike a password, cannot be reset. W Social says public data never contains passport images, passport numbers, selfies, or real dates of birth.

Sources: Cybernews