500px 500px.com 500px data breach: what happened and what to do
In mid-2018 the photo community 500px was breached. Almost 15 million accounts leaked with names, usernames, email addresses, birth dates, genders and MD5 or bcrypt password hashes. 500px forced password resets in 2019.
View all 13,115 breaches- Breach date
- 5 Jul 2018
- Affected
- 14,867,999
- Data exposed
- Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In mid-2018, the photography community 500px suffered a data breach. The company says it became aware of a security issue on February 8, 2019, after the data started circulating, and published an FAQ for members. Have I Been Pwned (HIBP) added the breach on March 25, 2019 and lists it as verified.
What happened
The intrusion dates to around July 5, 2018. In early 2019 the data appeared for sale on a dark web marketplace, alongside several other large breaches, and later spread more widely. 500px said anyone who had an account on or before July 5, 2018 was affected, and it required users to reset their passwords.
What was exposed
HIBP counts 14,867,999 accounts. The exposed fields were dates of birth, email addresses, genders, geographic locations, names, passwords and usernames. Passwords were stored as hashes, either MD5 or bcrypt. bcrypt is a strong, slow hash that is hard to crack. MD5 is fast and weak, so accounts with MD5 hashes are the ones at real risk.
According to 500px's FAQ, payment card data wasn't in the stolen set.
What that lets criminals do
The password hashes are the first concern. If yours was MD5 and your password was common, assume it's cracked and tried on other sites. The birth dates add to a profile that identity thieves can combine with data from other breaches. Names plus locations also make phishing more convincing.
What to do now
Change your 500px password if you haven't since 2019, and change it anywhere you reused it. Turn on two-factor login on your email. If you gave a real birth date, know that it's out there and be careful with calls or emails that use it to "verify" you.
What to do if you were in it
- 1
Change your 500px password, and every reuse of it
500px forced resets in 2019, but if you reused that password on other sites, change it there too. Use a password manager for unique passwords.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email and other important accounts.
- 3
Be careful with birth-date checks
Your date of birth is out there. Don't treat a caller or email that knows it as proof of identity.
- 4
Expect phishing that fits the data
Don't click links in messages about your account. Go to the site yourself.
- 5
See which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone.
Frequently asked
Was I affected by the 500px breach?
If you had an account on or before July 5, 2018, yes. Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 14,867,999 accounts.
What was exposed in the 500px breach?
Dates of birth, email addresses, genders, locations, names, usernames and password hashes (MD5 or bcrypt).
Were credit cards exposed?
500px's FAQ says payment card data wasn't part of what was taken.
Should I change my password?
Yes, if you haven't since 2019, and on any site where you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
