CodeStepByStep Breach Exposes 103,077 User Accounts
What Happened – In November 2025 the online coding‑practice platform CodeStepByStep suffered a data breach. An initial set of ~17 k records was leaked, and a second dump in December raised the total exposed accounts to 103 077. The compromised data consist of users’ names, usernames and email addresses.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate identity‑and‑access controls that allow bulk extraction of user credentials.
- Highlights the need for continuous monitoring and evidencing of access‑control policies to satisfy audit requirements.
- Shows how a single data‑exposure event can generate defensible evidence for regulatory or framework‑based reviews.
Who Is Affected – SaaS providers in the education/technology space, their end‑users, and any downstream services that integrate with CodeStepByStep.
Recommended Actions
- Review and harden authentication mechanisms (e.g., enforce MFA, limit credential reuse).
- Implement continuous logging of account‑access events and retain logs for auditability.
- Conduct a data‑classification exercise and apply encryption or tokenization to personally identifiable information.
- Update incident‑response playbooks to include rapid notification and evidence‑collection steps.
Source: Have I Been Pwned – CodeStepByStep breach
Technical Notes – The breach was disclosed via public data‑leak feeds; no specific vulnerability (CVE) has been identified, and the attack vector remains unknown. Exposed data: email addresses, names, usernames. Source: same as above