European X alternative W Social denies leaking personal data to the open web

W Social, a European social media platform, believes users themselves should decide which of their data should be made public.

The company released a statement on October 14th, 2026, following findings by German tech journalist Gavin Karlmeier, who revealed a publicly visible database containing W Social accounts.

Over 2,500 users allegedly had their nationality, and almost 2,000 had their full names published on the open web. In some rare cases, email addresses were visible, according to Karlmeier.

W Social, which opened to the public in beta in June 2026 as a privacy-focused social media that requires real user identities to stave off bots, said no personal data has been leaked, accessed without authorization, or inadvertently published.

“The verification records contain only the information that users chose to make publicly available when creating an account on our platform. We have assessed the matter in consultation with our Data Protection Officer and have documented that assessment,” the statement reads.

The company added that there has been no personal data breach under the General Data Protection Regulation (GDPR).

Karlmeier’s findings, however, raised concerns among 55,000 of the platform's users, according to the data from June.

W Don’t Have Time, an investigative collective, has released Have you been Wned?, an online checker where W Social users can learn how much of their personally identifiable information is published on the open web.

Is the AT Protocol to blame?

W Social partly admitted the publication of user data, explaining that it’s due to the public nature of the platform’s underlying AT Protocol developed by Bluesky Social PBC, an American company that owns the social media platform Bluesky.

When a user verifies their account, W Social writes a verification record to its moderation account on the AT Protocol, according to the company.

“Like all profile data on the AT Protocol, this record is public – this is how users can see that an account belongs to a verified human. The record contains the verification status, the country that issued the user’s passport, a synthetic date of birth used to derive an age range, and – only for users who have chosen to share their legal name – that name,” the statement reads.

Aras Nzarovas, a senior information security researcher at Cybernews, says W Social publicly publishes information such as first and last names, email addresses, nationalities, and approximate dates of birth.

However, most records are anonymous, only having metadata such as IDs, “created at,” and “verified at” information. While the actual date of birth is sometimes added to a person’s last name, it appears to be wrong by approximately 6 months.

However, unintended data slips show that W Social’s verification systems are “imperfect” and could likely be “easily bypassed.”

The company cannot actually control what private data they are exposing. If a user typed in their address as their last name, they would publish it. Removing this data from a decentralized system can be difficult after mistakes are made.

Aras Nzarovas, a senior information security researcher at Cybernews

What are the risks?

Nazarovas says malicious hackers could misuse public verification data for “doxxing” or targeted phishing attacks. For example, they could personalize messages based on users’ nationality, age, and name.

“Some platforms may use information such as age, names, and nationality as a second layer of security to verify a user’s identity over the phone or chat. Leaking this information could lead to simplified account takeovers in these cases,” he says.

Nazarovas notes that threat actors usually combine data from multiple leaks. Therefore, this publicly available information could be used as a verified source to confirm previously leaked data and enrich it with nationality or approximate date of birth.

Controversy over verification methods

Since W Social was announced in early 2026, the platform has been criticized for its user verification methods, which require users to upload their passport or biometric data, such as a selfie, to a companion app, W Identity.

The company repeatedly said that the W Identity app is decentralized and stores data directly on the user’s device, while documents from W’s servers are deleted “immediately after the verification process is completed.”

Cybernews researchers, however, emphasize that biometric data and documents are “highly sensitive” and are actively sought by hackers. Uploading such data online creates a “permanent identity record,” which, unlike a password, cannot be reset.

In its latest statement, W Social says the publicly available data never contains passport images, passport numbers, selfies, real dates of birth, or any other passport information.

“No verification record, and no data repository on W Social’s Personal Data Server, contains users’ email addresses – unless a user has chosen to use an email address as their handle or display name,” the statement reads.