Pixlr pixlr.com Pixlr data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In October 2020, the photo editing app Pixlr suffered a data breach exposing 1.9 million subscribers: names, email addresses, social media profiles, country and passwords stored as SHA-512 hashes.
View all 13,118 breaches- Breach date
- 7 Oct 2020
- Affected
- 1,906,808
- Data exposed
- Email addresses, Geographic locations, Names, Passwords, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Pixlr is an online photo editor. In October 2020, a breach exposed the records of 1.9 million of its subscribers. The data became widely public in January 2021, when a copy of it was posted online for free.
Pixlr's parent company, Inmagine, also owns the stock photo site 123RF, and press coverage tied the two incidents together. Coverage at the time reported no statement from Pixlr itself.
What was exposed
Have I Been Pwned lists names, email addresses, social media profiles, the country each person signed up from, and passwords stored as SHA-512 hashes.
What that means for you
SHA-512 is a stronger hashing method than the older ones used in many breaches, but weak or common passwords can still be guessed offline. If your Pixlr password was simple, or you used it elsewhere, change it everywhere.
The email and name pairing is enough for phishing. A message that says it's from Pixlr or another design tool, and knows your name, is easier to believe. The links to your social profiles also make it easier for someone to build a believable story about you.
Sources checked: haveibeenpwned.com, itpro.co.uk
Last verified against the official page:
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new, unique password on Pixlr first. Then change it on any other account that shares the old one, starting with your email. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Use an authenticator app on your email, bank and shopping accounts. A leaked password alone then won't get anyone in.
- 3
Be careful with messages that use your name
Phishing that mentions a photo app, a subscription or a login problem is a typical follow-up to this kind of leak. Open the site from your own bookmark.
- 4
Check whether your email is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your email or phone number shows up. It can't remove data from a breach, but it tells you which accounts to secure first.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Pixlr breach?
If you had a Pixlr account in 2020, possibly. Search your email address on Have I Been Pwned, or run a free scan with Serus.
What was exposed in the Pixlr breach?
Names, email addresses, social media profiles, country and passwords stored as SHA-512 hashes.
Should I change my password?
Yes, if you ever used it on Pixlr or anywhere else. Make each password unique.
Sources
- Have I Been Pwned: Pixlr
- Have I Been Pwned: Pixlr Data Breach · haveibeenpwned.com
- Pixlr data breach exposes over 1.9 million user records · itpro.co.uk
Something wrong or out of date? Tell us and we'll re-check it.
