imgur data breach: 1.7M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2017-11-25
In September 2013, the online image sharing community imgur suffered a data breach. A selection of the data containing 1.7 million email addresses and passwords surfaced more than 4 years later in November 2017. Although imgur stored passwords as SHA-256 hashes, the data in the breach contained plain text passwords suggesting that many of the original hashes had been cracked. imgur advises that they rolled over to bcrypt hashes in 2016. Exposed data: email addresses, passwords. The breach dates from Sep 1, 2013; Have I Been Pwned loaded it on Nov 25, 2017.
What to do
- If you had a imgur account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
