Photo-Sharing Site Imgur Investigating Serious 2014 Hack

4shares

Imgur has confirmed that it is investigating a hack that took place in 2014, during which hackers stole over 1.7 million email addresses and passwords.

It all began last week when Troy Hunt – the man who runs Have I Been Pwned – was sent data stolen from Imgur almost four years ago. Hunt informed Imgur straight away on Thanksgiving, and Imgur took immediate action, resetting passwords on the accounts that were affected, and notifying users of the breach.

On November 23, we were notified about a data breach on Imgur that occurred in 2014. While we are still actively investigating the intrusion, we wanted to inform you as quickly as possible as to what we know and what we are doing in response. More: https://t.co/qElAetGVIc
— Imgur (@imgur) November 25, 2017

According to Imgur, hackers stole 1.7 million email addresses and passwords that had been scrambled with the SHA-256 algorithm. In case you’re wondering, SHA-256 isn’t generally used anymore, as there are stronger scramblers available. Also, the breach – which Imgur is still actively investigating – did not reveal any personal information like real names, addresses, phone numbers, etc. The site doesn’t ask for this information.

Despite containing data from only a small fraction of the photo-sharing site’s 150 million monthly users, the hack is still significant enough. In fact, roughly 60% of Imgur‘s hacked email addresses were already on Have I Been Pwned – which contains over 4.8 billion records. Despite being only identified now, the hack joins a list of other big ones in the past years – on sites like Disqus, LinkedIn, MySpace, and Yahoo.

Imgur’s COO Roy Sehgal announced that the company is “still investigating” how the breach actually happened, but has now improved its site security since the news broke. Also, Imgur had switched to Bcrypt – a stronger password scrambler – last year, which means that if you weren’t affected by this hack it’s highly possible that you are ok. In any case, we suggest that if you use the same email/password combination on other sites, you should probably change them immediately.

Where you affected by Imgur’s hack of 2014? 1.7 million emails and passwords stolen.

Click To Tweet