Flickr Reports Data Breach Linked to Third-Party Email Provider

Flickr, the legacy image-sharing platform owned by SmugMug, reported a data breach that occurred on February 5. The breach was attributed to a third-party email service provider, although the provider’s identity was not disclosed. Upon discovering the breach, Flickr quickly disabled access to the affected system and removed links to the vulnerable endpoint.

The company informed users that the breach may have compromised various types of personally identifiable information (PII), including names, email addresses, usernames, account types, IP addresses, general locations, and Flickr activity. The extent of the data accessed varies by account, and no passwords or financial information were affected.

Flickr’s email to users also indicated that the breach could have implications across multiple regions, as it operates in 190 countries and included links to both European and US data protection authorities. With approximately 35 million active users monthly, the potential impact of the breach is significant.

Implications for Users

In light of this breach, users should be vigilant about potential phishing attempts that may reference their accounts. Flickr emphasized that it will never ask for sensitive information like passwords via email. Users are advised to review their account settings for any unexpected changes and to consider changing passwords, especially if they use the same password across multiple services.

Flickr has committed to conducting a thorough investigation and enhancing its security measures with third-party providers to prevent similar incidents in the future. This incident highlights the risks associated with third-party services and the importance of robust security practices.