China Software Developer Network Breach Exposes 6.4 M Email, Username, and Plain‑Text Password Records
What Happened — In 2011 the China Software Developer Network (CSDN) suffered a data breach that leaked 6,414,990 user records. The exposed data included email addresses, usernames, and passwords stored in plain text.
Why It Matters for Trust & Control Assurance
- Unhashed credentials are a classic control‑gap that continuous‑monitoring programs are built to detect and remediate.
- Demonstrates the need for documented password‑hashing policies and evidence of their enforcement for audit readiness.
- Highlights the importance of multi‑factor authentication and credential‑access reviews as defensible control evidence.
Who Is Affected — SaaS platforms, developer portals, and any service that stores user credentials.
Recommended Actions
- Replace plain‑text storage with strong hashing (e.g., bcrypt, Argon2) and rotate compromised passwords.
- Enforce MFA for all user accounts and review privileged access regularly.
- Conduct a credential‑storage audit, capture evidence of hashing and MFA controls, and map findings to your control‑assurance framework. Source: Have I Been Pwned – CSDN breach
Technical Notes — The breach exposed email addresses, usernames, and passwords in clear text. No specific vulnerability or attack vector was disclosed. Source: Have I Been Pwned – CSDN breach