Security flaw in the Hudd app hit vulnerable and at-risk users

On Friday, S&P discovered a security flaw whereby users in closed groups on Hudd were publicly exposed within the application. All users had access to members' names and postal town, which affects members of vulnerable and at-risk groups.

September 5, 2026

SOURCES | SOCIETY

Picture from the Hudd App

Security flaw in the Hudd app hit vulnerable and at-risk users

On Friday, S&P discovered a security flaw whereby users in closed groups on Hudd were publicly exposed within the application. All users had access to members' names and postal town, which affects members of vulnerable and at-risk groups.

Vipps login does not automatically mean privacy

Hudd was launched in November 2024 and was meant to become a safe Norwegian alternative to international social media such as X and Facebook. Hudd uses Vipps/BankID (Norwegian digital ID) for login and markets itself on the claim that the application consists solely of real people. But no one is safe, despite Vipps, if they are registered in an application that is not safe.

Privacy functionality in Hudd

Hudd also uses the Vipps login to register new users. According to its privacy policy, it automatically imports name, date of birth, address, telephone number and email address.

In profile settings, the user can choose to hide certain personal data. But the user cannot opt out of their name, or use a fictitious name. Nor can they opt out of postal town unless they are registered with a confidential address in the National Population Register.

Display of name and postal town in Hudd

The user's profile, which is used throughout the application, consists of name, photo if they have one, and postal town. Since Hudd has a neighbourhood profile, place of residence has been central to the development of the application.

Group functionality

Users can join groups created by other users. According to Hudd's own website, there are more than 18,000 groups on Hudd. S&P previously had a debate group on Hudd with 8,600 members; it has now been deleted for several reasons. Read S&P's assessment of Hudd here.

If you click on a closed group you are not a member of, you are met with a notice saying "This group is closed" — see randomly selected group below.

Hudd displayed closed groups' member lists

Yesterday, S&P discovered by chance that the member list for closed groups was openly available in Hudd. Clicking on the member count exposed the list; you will find an example from the group that was first discovered in the source at the bottom.

After clicking through a great many groups, S&P found that this probably applied to all closed groups on Hudd, and not least that many of these are at-risk and vulnerable. Following that discovery, notification was sent to Hudd and the Norwegian Data Protection Authority immediately.

Vulnerable members were exposed

The situation is serious because members of vulnerable groups were shown with name and postal town. To mention a few, this applies to groups about faith, about illness, about substance abuse, about sexual orientation. A ninth-grade class is also among the groups S&P has documented. The documentation S&P has gathered is being sent to the Norwegian Data Protection Authority.

Hudd has just over 220,000 users and 18,000 groups, according to its own website, which gives reason to believe that many are affected.

Hudd confirms the flaw, but offers no apology

In an email to S&P today at 12:35, Hudd confirmed that the flaw was fixed late last night, but does not state how long the member lists lay open in the application before S&P reported the flaw four hours earlier. Hudd further says that the flaw applied only to certain closed groups, but this does not match what S&P has found.

It does not appear that Hudd has notified those affected following the incident; the email states: "We follow our ordinary routines for handling privacy incidents and will of course fulfil our obligations towards the Norwegian Data Protection Authority and any affected users if the conditions for this are met."

Article 34 of the GDPR states that the data controller (Hudd) shall notify the individual without undue delay when a security breach is likely to result in a high risk to that person's rights and freedoms.

Hudd offers no apology to those affected in the aforementioned email.

Sent third-party product advertising

This is not the first time Hudd has failed in relation to its privacy obligations. Earlier this week, the company sent out problematic third-party advertising to its users, without obtaining consent in advance and without ensuring that the content was within the Marketing Control Act. The matter was pointed out by S&P earlier this week, and was acknowledged as an error by Hudd. Read more about that case here.

Privacy risk

As this is published, Hudd has still not, on a general basis, reported the security flaw to the 220,000 users of the application. Users are thus left uninformed that the company has a security breach, and are thereby deprived of information necessary to assess the privacy risk of using the application.

The company's handling of its privacy obligations does not appear reassuring.

Updated 7 September 2026

Hudd has informed S&P in a new email that the case concerned the group type Public and Closed, and that the member list being public is intended. However, the member list was closed on Friday evening and is still closed when S&P checks. This means that the member lists in groups with this setting, including vulnerable and at-risk groups, have been public in Hudd right up until Friday.

Given that this is a sensitive matter, S&P is being cautious about sharing the aforementioned documentation publicly. As mentioned above, the documentation is being sent to the Norwegian Data Protection Authority, which is the proper body.

DO YOU HAVE A TIP?

Do you have a tip in this case, or other cases about Hudd?
All tips are treated confidentially.
Send an email to post@samfunnogpolitikk.no