China Software Developer Network csdn.net CSDN data breach (2011): what happened and what to do
In December 2011, a file with about 6.4 million CSDN (China Software Developer Network) accounts leaked: email addresses, usernames and plain text passwords. Have I Been Pwned added it in November 2025. It's old, but it still matters if you reused that password.
View all 13,177 breaches- Breach date
- 21 Dec 2011
- Affected
- 6,414,990
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
The China Software Developer Network (CSDN) is one of the biggest sites for programmers in China. In December 2011 a file of its user records spread online. Have I Been Pwned (HIBP) gives the breach date as 21 December 2011 and counts 6,414,990 accounts. It added the data on 27 November 2025, long after the original leak.
What happened
December 2011 is when the data surfaced. Chinese police later said most of the records dated from 2009 to 2010, which suggests the server was compromised earlier. The Hacker News reported that a suspect was arrested in February 2012 and held on charges of illegally obtaining computer data. Dark Reading reported that police also found other supposed breaches tied to the incident were hoaxes.
Sources checked: haveibeenpwned.com, thehackernews.com, darkreading.com
Last verified against the official page:
What was exposed
HIBP lists three types of data:
Email addresses Usernames Passwords
The passwords were stored in plain text. Anyone with the file could just read them.
Why a 14-year-old breach still matters
A breach from 2011 sounds harmless by now. Often it isn't.
People reuse passwords for years. Say you signed up around 2010 with a password you also used for your email, a forum or a shop, and never changed it. That pairing has sat in a circulating file for over a decade, and attackers keep old lists because the logins still work often enough to try.
Plain text passwords also show attackers how people pick passwords. Lists like this feed the dictionaries used in later guessing attacks. Your CSDN password may be long dead, but if you build new passwords the same way, the pattern can still give you away.
Your email address in the file also puts you on spam and phishing lists. A fake notice from a code-hosting or cloud service lands better with someone whose email is tied to a developer site.
The company's response
According to coverage of the case, police punished CSDN for storing its data poorly. The company apologised to its users and said its server had been properly protected since September 2010. Chinese authorities said they found nine cases of the data being resold.
What to do now
If you had a CSDN account, treat that password as public. Work out where else you used it and replace it there. Can't remember? Start with your email account, your banking and anything tied to your work.
What to do if you were in it
- 1
Change your CSDN password, and any you reused
Change it on CSDN first, then on every other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey where the site offers one. It stops most account takeovers even when a password has already leaked.
- 3
Search for old passwords you still use
If you reused your CSDN password on any other account, replace it. Start with your email, then banking and work accounts.
- 4
Treat messages that mention the breach as suspect
Expect emails and texts that quote your name or details to look convincing. Don't click links in them; open the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 5
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the CSDN data breach?
Check your email on Have I Been Pwned. If China Software Developer Network is listed, your email, username and password were in the leaked file.
What was exposed?
Email addresses, usernames and plain text passwords, according to Have I Been Pwned.
Why was this added to Have I Been Pwned in 2025?
HIBP added the data to its database on 27 November 2025, long after the 2011 leak, so people can look up their exposure.
Should I change my password?
Yes, if you ever used that CSDN password anywhere else. Replace it on every account that shared it and turn on two-factor login.
Sources
- Have I Been Pwned: CSDN
- Have I Been Pwned: China Software Developer Network Data Breach · haveibeenpwned.com
- Chinese hacker arrested for leaking 6 million logins from CSDN · thehackernews.com
- darkreading.com/cyberattacks-data-breaches/china-arrests-four-in-csdn-data-breach-related-breaches-proved-to-be-hoaxes
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- Page text rewritten in plainer language; no facts changed.
