Every funded futures trader has done it: uploaded an ID, typed in a Social Security number and filled out tax forms so the prop firm can pay out. In early January 2026, some Topstep traders found out what can happen to that data. Letters went out telling them that their names and Social Security numbers may have been exposed.
What happened
According to Finance Magnates and ClaimDepot, which tracks breach notifications filed with state attorneys general, the incident is linked to a distributed denial-of-service (DDoS) attack on 8 September 2025. Between 8 September and 16 October 2025, certain files containing users' personally identifiable information may have been subject to unauthorized access or acquisition. Affected traders received letters in early January 2026.
The reported numbers and scope:
- 1,920 individuals were affected, according to the disclosure filed in Maine, as reported by ClaimDepot.
- Exposed data types reportedly included names, addresses and Social Security numbers, among other sensitive information.
- Topstep notified the Texas Attorney General and reported the breach to the attorneys general of Indiana, Maine, Massachusetts and New Hampshire, per the same reporting.
- Topstep is offering affected users 24 months of Experian IdentityWorks, including credit monitoring, identity restoration and up to $1 million in identity theft insurance.
Topstep's support team said on social media that the breach did not involve the prop firm's systems and affected only a "small number of traders", according to Finance Magnates. BrokersView also reported on the leak.
Why this matters beyond Topstep
Most futures prop coverage is about drawdown rules and payout caps. Data security rarely makes the list, yet every U.S. futures prop trader who gets paid hands over tax and identity data. A funded trader might have that data sitting with three, five or ten firms at once, plus their payment processors and KYC vendors. Each one is a potential leak.
The Topstep incident is also a reminder that "not our systems" is not the same as "not your problem." When a firm's statement says its own systems were not involved, the natural follow-up questions are: whose systems were, and which vendors hold trader data? Based on the public reporting we found, those details were not spelled out. One security write-up used the incident to argue that funded traders should treat KYC data sharing as a real risk.
The two readings
The measured reading: 1,920 affected people is a small share of a large trader base, the firm notified multiple state attorneys general, and it offered two years of credit monitoring and identity insurance. That is a standard, compliant breach response.
The critical reading: the suspicious activity window ended in mid-October 2025, but letters arrived in early January 2026, roughly three months after the window closed. Social Security numbers cannot be reset like passwords. And the company's public messaging leaned on minimizing scope rather than explaining what happened.
What traders can do (general, not advice)
- If you got a letter, enroll in the offered monitoring and consider a credit freeze with the major bureaus.
- Inventory your exposure. List every prop firm and payout processor that has your ID and tax details.
- Close dormant accounts at firms you no longer use and ask what data they retain.
- Watch for phishing. Leaked names and addresses are often used for targeted scams that mention the firm.
Key takeaways
- Topstep notified some traders in early January 2026 that names and Social Security numbers may have been exposed.
- The incident is tied to a DDoS attack on 8 September 2025, with possible unauthorized access through 16 October 2025.
- A Maine filing reported 1,920 affected individuals; several state attorneys general were notified.
- Topstep said its prop firm systems were not involved and offered 24 months of Experian IdentityWorks.
- Every funded trader should treat identity data held by prop firms as part of their risk.
Put the research to work on your Desk
Explore the tools behind the research, compare the available access, or open your Desk if you already have an account.
FAQ
Was Topstep hacked?
Topstep notified some users that personal information may have been accessed between 8 September and 16 October 2025, linked to a DDoS attack. Its support team said the breach did not involve the prop firm's systems.
How many Topstep users were affected?
A disclosure filed in Maine reported 1,920 affected individuals, according to ClaimDepot.
What is Topstep offering affected traders?
24 months of Experian IdentityWorks, including credit monitoring, identity restoration services and up to $1 million in identity theft insurance.
Loomi.Ai provides educational market research, not financial advice. Trading futures and options involves substantial risk of loss, and backtested results are historical and do not guarantee future returns.
Sources
- Some Topstep Users' Details Exposed, Finance Magnates
- Some Topstep Users' Names and Social Security Numbers Exposed, Finance Magnates via TradingView
- Topstep Data Breach Exposes SSNs and Addresses, ClaimDepot
- Proprietary Trading Platform Topstep Users' Personal Information Leaked, BrokersView (FastBull)
- Topstep Data Breach Exposed Trader SSNs, Mubite