What Happened in the CodeStepByStep Data Breach?
CodeStepByStep, an online coding practice tool used by students and instructors, suffered a data breach that came to light in November 2025. According to breach-tracking records, unauthorized parties published a set of roughly 17,000 records stolen from the platform. This initial release raised immediate concerns about the security of user accounts on the site.
The situation grew more serious the following month. As a result, a second and much larger batch of data appeared online, bringing the total number of exposed records to approximately 103,000. This means the breach affected a far larger group of people than first believed. The exact method the attacker used to gain access has not been publicly disclosed.
Because the data appeared on public channels in two separate waves, researchers were able to confirm the exposure directly. In addition, the timing suggests the attacker may have retained access or additional stolen data even after the first release became public. There is no indication in available records of exactly when the underlying intrusion into CodeStepByStep’s systems first occurred, only when the stolen data surfaced.
Who was affected?
CodeStepByStep primarily serves students, self-taught programmers, and instructors who use the platform to practice coding exercises. Given the nature of the service, the breach likely affected a mix of students, including some who may be minors, along with educators and independent learners who created accounts on the site.
The confirmed total stands at approximately 103,000 affected records, based on the combined releases from November and December 2025. It has not been publicly disclosed whether affected users are concentrated in the United States or spread across a global user base. However, any US-based students, instructors, or account holders who registered on CodeStepByStep should consider themselves potentially impacted.
Because coding education platforms are often used in school and university settings, there is a real possibility that younger users are among those affected. This raises additional concerns given that minors may not actively monitor their own accounts or personal information for signs of misuse.
What Information Was Potentially Exposed?
The data published from the CodeStepByStep breach centers on account and identity information rather than financial records. Even so, this type of exposure can still create meaningful risk for affected individuals. Below is a summary of the specific data categories confirmed in the breach.
- Full names
- Usernames
- Email addresses
Although this breach did not expose Social Security numbers or financial account details, exposed names and email addresses can still be misused. For example, attackers frequently combine this kind of data with information from other breaches to build more convincing phishing campaigns. Because usernames were also exposed, attackers may attempt to reuse these credentials on other platforms where users repeated the same username or similar passwords.
In addition, exposed email addresses are often sold or shared among cybercriminals for use in spam and targeted phishing attempts. This is especially concerning for younger users who may be less experienced at recognizing suspicious messages. As a result, affected individuals should treat any unexpected emails referencing CodeStepByStep with caution, even if the message appears to come from a legitimate-looking source.
What is the company doing?
Public information about CodeStepByStep’s specific response has not been widely disclosed. Typically, once a breach becomes public through data being posted online, affected organizations begin an internal investigation to determine the scope and cause of the exposure. It is not yet clear whether CodeStepByStep has confirmed the root cause of this incident.
Because a second, larger batch of data was released after the initial 17,000-record leak, this suggests the platform’s remediation efforts, if any, may not have fully contained the exposure right away. Affected users should watch for official communications from CodeStepByStep regarding password resets or other security recommendations. In the meantime, individuals should assume their account information may be circulating and take independent precautions.
What Should Affected Individuals Do?
Change Your Password and Enable Extra Protections
Anyone with a CodeStepByStep account should change their password immediately. This is especially important if the same password was used on any other website or service.
Because usernames and emails were exposed together, attackers may try automated login attempts using this data paired with commonly reused passwords. Therefore, enabling two-factor authentication wherever possible adds an extra layer of protection beyond just a password change.
Watch for Phishing Attempts
Affected users should remain alert for suspicious emails claiming to be from CodeStepByStep or related educational services. Attackers often use stolen names and email addresses to craft messages that appear personalized and trustworthy.
For example, a phishing email might reference your real name and ask you to