123RF Data Breach
The 2020 123RF breach is a dataset dated to March 2020 and associated with 8,661,578 accounts. Reported fields are emails, IP addresses, names, passwords, phones, physical addresses, and usernames.
Exposed Data Types
7- Email addresses
- IP addresses
- Names
- Passwords with unresolved representation
- Phone numbers
- Physical addresses
- Usernames
About This Breach
March 22 is the structured date and does not by itself prove the initial-access or exfiltration day.
The local record measure is 8,582,653, a difference of 78,925 from the external account measure. Neither number means people, active customers, or rows containing every field together. Passwords must not be called plaintext, assigned a specific hash algorithm, or treated as directly usable credentials until storage representation and field prevalence are authenticated from the original schema.
A row establishes only actual fields in the attributed dataset. It does not establish identity, an active 123RF account, photographer or customer role, content licensing or purchases, IP or location, phone, address, or password ownership, field co-occurrence, account takeover, or misuse.
If a password field is authenticated and the old password was reused elsewhere, it should be replaced. Contact, address, IP, and credential associations must remain private, and unexpected requests quoting correct profile details should be checked through an independently obtained official channel.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
