Imgur Data Breach
The Imgur data breach was confirmed after a security researcher supplied the company with historical account data in November 2017. Imgur's archived notice says approximately 1.7 million accounts were affected in 2014.
Exposed Data Types
2- Email addresses
- Passwords
About This Breach
A verified breach index instead places the event in September 2013 and reports 1,749,806 accounts. Because the sources do not explain the year conflict, the title does not assign a definitive incident year and neither 2013 nor 2014 is presented as undisputed.
Imgur said the compromised account information consisted only of email addresses and passwords. The company stated that it did not ask users for real names, physical addresses, phone numbers, or other directly identifying information and that those fields were not involved. This record also does not establish exposure of payment cards, private messages, or uploaded images.
How were the passwords protected?
The first-party notice says passwords were stored as SHA-256 hashes at the time and that some values may have been brute-forced because of the older algorithm. The verified index says plaintext password values later appeared in the circulated data, suggesting that many of the captured hashes may subsequently have been cracked. These statements are compatible: storing hashes in the service does not prevent an attacker from guessing some original passwords after obtaining those hashes.
Imgur's response and safe next steps
The company said it validated the data on 24 November 2017, began notifying affected users, and required password changes. It also said it had moved to bcrypt in 2016; the initial access method and actor remain unconfirmed in the public sources. If the password used at the time, or a similar one, remains active elsewhere, replace it with a unique password and enable multifactor authentication. An email match alone does not prove that a person's current Imgur account is compromised today.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
