imgur imgur.com imgur data breach: what happened and what to do
imgur's data was breached in September 2013 and surfaced in November 2017. Have I Been Pwned lists 1,749,806 accounts with email addresses and passwords. imgur said it moved to bcrypt hashing in 2016.
View all 13,115 breaches- Breach date
- Sept 2013
- Affected
- 1,749,806
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
imgur, the image sharing community, suffered a data breach in September 2013. A selection of the data, with 1.7 million email addresses and passwords, surfaced more than four years later, in November 2017. Have I Been Pwned lists 1,749,806 accounts.
What was in the data
imgur stored passwords as SHA-256 hashes. The data in the breach, however, contained plain text passwords, which suggests that many of the original hashes had been cracked. imgur advised that it had moved to bcrypt hashing in 2016. Press reports said the company believed the hack might have been a brute force attack on the older SHA-256 hashes. Only email addresses and passwords were involved.
How it came to light
Security researcher Troy Hunt notified imgur about the data. The company began emailing affected users on November 24, 2017 and required them to reset their passwords. Coverage at the time noted it was unclear how imgur's systems were breached or why it took years to discover.
What it means for you
Plain text passwords paired with an email address are the most useful kind of leaked data for criminals. They can be tried straight away on your email, shopping and banking accounts. If you used your imgur password anywhere else, that account is the real target.
The data holds no payment details, so the main danger is account takeover rather than card fraud. A taken-over email account can reset passwords everywhere, so protect that one first.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Set a new, unique password on imgur. If you used the same password on other accounts, change those too. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Add 2FA to your email, banking and shopping accounts first. If an old password is still in circulation, a second step stops most takeover attempts.
- 3
Secure your email account first
Your email can reset every other account. Give it a strong, unique password and 2FA before anything else.
- 4
Check whether your email is in this and other breaches
Run a free Serus scan. It checks your email and phone number against breach databases and the dark web, and Serus alerts you if they show up in a new one.
Frequently asked
Was I affected by the imgur breach?
Have I Been Pwned lists 1,749,806 accounts. Search your email on its site, or run a free Serus scan.
What was exposed in the imgur breach?
Email addresses and passwords. The passwords appeared in plain text, which suggests many hashes had been cracked.
Should I change my password?
Yes, on imgur and anywhere you reused it. imgur required affected users to reset theirs.
Has imgur fixed password storage?
imgur said it moved to bcrypt hashing in 2016.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
