EyeEm eyeem.com EyeEm data breach: what happened and what to do
In February 2018, photography site EyeEm was breached. Almost 20 million email addresses leaked with names, usernames, bios and password hashes. The data was later offered for sale in 2019.
View all 13,115 breaches- Breach date
- 28 Feb 2018
- Affected
- 19,611,022
- Data exposed
- Bios, Email addresses, Names, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In February 2018, the photography community EyeEm suffered a data breach. Have I Been Pwned identified it among a collection of other large incidents in early 2019, when The Register reported that account details stolen from 16 sites were on sale on the dark web.
What was exposed
About 19.6 million unique email addresses leaked, along with names, usernames, bios and password hashes. Profile bios are free text, so some people wrote an employer, city or website in theirs.
What it means for you
A name tied to an email address is enough for a convincing phishing message, and a bio can add details that make it more believable. The password hashes can be cracked when a password is simple, which puts any account that reused it at risk.
Can the data be taken down?
No. Once a breach is copied and shared, nobody can pull it back, and the company can't either. What you control is how useful the data is to criminals: unique passwords, two-factor login and skepticism toward messages that quote your details. Serus monitors breach databases and the dark web for your email and phone and alerts you when your details appear in a new leak.
What to do
Change your EyeEm password and every reuse of it, turn on two-factor login, and be skeptical of messages that use your name or mention photography.
What to do if you were in it
- 1
Change your EyeEm password, and any you reused
If you used the same or a similar password on another account, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey on your email and other important accounts. It blocks most takeovers even when a password is already out.
- 3
Expect phishing that fits the data
Expect emails that use your real name and mention photos or your account. Go to the site yourself rather than clicking links.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up again.
Frequently asked
Was I affected by the EyeEm breach?
Look up your email on Have I Been Pwned or run a free Serus scan. If you had an EyeEm account in early 2018, assume you were.
What was exposed?
Email addresses, names, usernames, bios and password hashes for almost 20 million accounts.
Should I change my password?
Yes, on EyeEm and anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
