Topstep Notifies Some Customers of Possible Data Exposure Tied to 2025 DDoS Incident

Topstep has notified some customers that their personal information may have been exposed during a cybersecurity incident tied to a distributed denial-of-service attack that occurred on September 8, 2025.

According to a January 5, 2026 Finance Magnates report, a notice sent to affected customers said that between September 8, 2025 and October 16, 2025, certain files containing personally identifiable information may have been subject to unauthorized access or acquisition. The article also said Topstep later clarified on social media that the issue did not involve a direct breach of Topstep systems, but instead impacted a small number of traders whose credentials may have overlapped with breaches on non-Topstep sites.

The report says Topstep offered affected customers complimentary credit monitoring services. That response, combined with the public clarification from support, suggests the firm was trying to narrow the scope of the incident while still acknowledging that some users had received formal notification letters.

For traders, this is a meaningful operational and trust issue. Even if Topstep's internal systems were not the original source of the exposure, the fact that customer notices referenced potentially compromised personal information raises immediate questions around account security, credential reuse, and incident communication.

Why it matters: Security notices involving personal information can materially affect trader trust and may influence how customers manage passwords, account access, and ongoing risk with a prop firm platform.

Source: Finance Magnates, Some Topstep Users' Details Exposed.