123RF Data Breach (2020): What Was Exposed & What To Do

In March 2020, a data breach at the stock photography platform 123RF exposed records belonging to 8.7 million subscribers. The incident was reported on 22 March 2020, and the data later appeared for sale online. Passwords were stored as MD5 hashes, while other fields included email addresses, usernames, names, phone numbers, physical addresses and IP addresses. The dataset was later supplied to Have I Been Pwned by dehashed.com. The scale of the incident means that millions of individuals now face the possibility that their account details have circulated beyond the original service. Because the breach involved both contact information and hashed credentials, affected users may encounter follow-on attempts to access other online accounts that share the same email or password.

Inside the incident

The breach was publicly reported on 22 March 2020 and affected 8.7 million subscriber records. The exposed data included email addresses, usernames, names, phone numbers, physical addresses, IP addresses and passwords stored as MD5 hashes. The material was subsequently offered for sale online. No further technical details about the intrusion method, duration or precise date of access have been disclosed in public reporting.

How a breach like this happens

Incidents involving online service providers often begin with the exploitation of a vulnerability in web applications, exposed administrative interfaces or compromised third-party components. Once initial access is obtained, attackers may locate and copy user databases. In many cases the data is then packaged and sold or shared on underground forums. The presence of MD5-hashed passwords indicates that the stored credentials were protected by a one-way function, though MD5 is an older algorithm that can be processed more quickly by modern hardware than current standards.

123RF and its sector

123RF operates as a stock-image marketplace where users create accounts to license photographs, vectors and other creative assets. Services of this type routinely collect registration details, billing addresses and login credentials to manage subscriptions and purchases. A breach at such a platform is consequential because the data can be used for targeted phishing, account takeover attempts on other sites, or the compilation of larger datasets that combine contact information with verified email addresses.

The information in question

The records reported in connection with the incident contain email addresses, usernames, names, phone numbers, physical addresses, IP addresses and passwords stored as MD5 hashes. No additional categories of data have been confirmed as exposed.

What's at stake

Individuals whose information appears in the dataset may receive unsolicited messages that reference their account details or physical address. Re-use of the same password on other services increases the chance that those accounts could be accessed without further interaction from the user. For the organisation, the incident adds to the body of known breaches in the creative-content sector and may prompt renewed scrutiny of password-storage practices and access controls.

What to do if you're exposed

Users can begin by changing the password on their 123RF account and on any other service where the same password was used. Enabling multi-factor authentication where available reduces the value of a leaked password. Monitoring email accounts for unexpected login alerts or password-reset messages provides an early indication of attempted misuse.

• Change passwords on 123RF and any other sites that share the same credentials.
• Enable multi-factor authentication on accounts that support it.
• Watch for unusual login notifications or password-reset requests.
• Run a free exposure scan of your email address against known breach datasets to confirm whether your information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.