CodinGame: intruder abused an internal data-analysis tool to copy member databases; all passwords reset
Severity: high · Patch status: no-fix-needed · Since 2026-11-15
CodinGame told its members by email on 15 November 2026 that during the night of 7 to 8 November an unauthorized party exploited a vulnerability in an internal data-analysis tool and used it to copy data from some of its databases. CodinGame treats every account as potentially affected. The exposed data may include email address and username, profile details (name, city, country, school), dates and IP addresses of recent logins, hashed passwords, identifiers of linked social accounts, and for some members part of their private platform messages and details given when registering for sponsored challenges. CodinGame says it cut the access and fixed the vulnerability, reset every member password, signed out all sessions, rotated its service credentials, tightened access to internal tools, filed a police complaint and notified the CNIL and the UK ICO. It says it has seen no misuse of the data so far, and its investigation is still open. The notice does not name the tool, the vulnerability, the hashing scheme or the number of accounts. Expect phishing that uses CodinGame branding, job offers or coding tests as the lure.
What to do
- Set a new CodinGame password at your next sign-in, going to www.codingame.com directly rather than through an emailed link
- Change the password on any other site where you reused your CodinGame password, and turn on MFA there
- Treat unexpected emails or messages that mention CodinGame, job offers or coding tests as likely phishing, especially ones that ask you to click a link, download a file or enter a password
- If you linked GitHub, Google or other social accounts, review those accounts' authorized apps and recent sign-in activity (CodinGame says the leaked identifiers do not give access to them)
- Recruiting teams using CoderPad/CodinGame tests: warn candidates that fake coding-test invitations are likely
- Data-protection questions: codingame-incident@codingame.com
All live incidents on Threat Watch
