China Software Developer Network csdn.net CSDN data breach (2011): what happened and what to do
In December 2011, about 6.4 million CSDN accounts, the China Software Developer Network, leaked with email addresses, usernames and passwords in plain text. Have I Been Pwned added the data in November 2025. Old, but still a risk if you reused the password.
View all 13,115 breaches- Breach date
- 21 Dec 2011
- Affected
- 6,414,990
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
The China Software Developer Network (CSDN) is one of the largest sites for programmers in China. In December 2011 a file of user records from the site spread online. Have I Been Pwned (HIBP) lists the breach date as 21 December 2011 and counts 6,414,990 accounts. HIBP added the data to its database on 27 November 2025, well after the original leak.
The December 2011 date reflects when the data surfaced. Chinese police later said that most of the records dated from 2009 to 2010, which points to the server being compromised earlier. The Hacker News reported that a suspect was arrested in February 2012 and held on charges of illegally obtaining computer data. Dark Reading reported that police also found other supposed breaches linked to the incident were hoaxes.
What was exposed
HIBP lists three types of data:
- Email addresses
- Usernames
- Passwords
The passwords were stored in plain text, so anyone who obtained the file could read them directly. No cracking was required.
Why a 14-year-old breach still matters
You might expect that a breach from 2011 is harmless now. For many people it isn't, for two reasons.
First, people reuse passwords for years. If you signed up to CSDN around 2010 with a password that you also used on your email, a forum or a shopping site, and never changed it, that pairing is sitting in a file that has circulated for over a decade. Attackers keep these old lists because logins still work often enough to be worth trying.
Second, plain-text passwords teach attackers how people choose passwords. Lists like this one feed the dictionaries used to guess passwords in later attacks. Even if your CSDN password is long dead, patterns from it can be reused to guess your newer ones if you build passwords the same way.
Your email address in the file also lands you on spam and phishing lists. A developer-themed phishing message, for example a fake notice from a code-hosting or cloud service, is more convincing when it reaches someone whose email is tied to a developer site.
The company's response
According to coverage of the case, police punished CSDN for storing its data poorly, and the company apologised to its users and said its server had been properly protected since September 2010. Chinese authorities said they found nine cases of reselling the data.
What to do now
If you had a CSDN account, treat that password as public. Check whether you used it anywhere else and replace it. If you can't remember what you used, start with your email account, your banking, and any site tied to your work.
What to do if you were in it
- 1
Change your CSDN password, and any you reused
Change it on CSDN first, then on every other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey where the site offers one. It stops most account takeovers even when a password has already leaked.
- 3
Search for old passwords you still use
If you reused your CSDN password on any other account, replace it. Start with your email, then banking and work accounts.
- 4
Treat messages that mention the breach as suspect
Expect emails and texts that quote your name or details to look convincing. Don't click links in them; open the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 5
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the CSDN data breach?
Check your email on Have I Been Pwned. If China Software Developer Network is listed, your email, username and password were in the leaked file.
What was exposed?
Email addresses, usernames and plain text passwords, according to Have I Been Pwned.
Why was this added to Have I Been Pwned in 2025?
HIBP added the data to its database on 27 November 2025, long after the 2011 leak, so people can look up their exposure.
Should I change my password?
Yes, if you ever used that CSDN password anywhere else. Replace it on every account that shared it and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
