EyeEm Data Breach (2018): What Was Exposed & What To Do

People whose email addresses, names, and login details were stored by EyeEm now face the possibility that those details have circulated beyond the company’s control. When such information appears in large collections of breach data, it can be used for targeted phishing, credential-stuffing attacks against other services, or unwanted profiling. The incident was first noted publicly on 28 February 2018. It involved the photography platform EyeEm and exposed records belonging to 19.6 million individuals. The data included email addresses, names, usernames, biographical text, and password hashes. The breach was identified as part of a larger set of incidents rather than through a direct disclosure by the company at the time.

What happened

In February 2018 EyeEm, a photography website, experienced a data breach. The event was detected among a group of other large incidents and involved the exposure of nearly 20 million unique email addresses along with associated names, usernames, biographical information, and password hashes. No further technical details about the method of access or the exact timing of the intrusion have been made public.

How a breach like this happens

Incidents affecting online platforms commonly begin with the compromise of a web application, server, or third-party integration that stores user records. Attackers may exploit unpatched software, weak authentication controls, or stolen administrative credentials to reach databases containing account information. Once inside, they can copy files containing email addresses, names, and hashed passwords. The stolen material is sometimes later found in aggregated collections of breach data rather than being announced by the affected organisation.

Who is EyeEm?

EyeEm operates an online service that allows users to upload, share, and license photographs. Like other platforms in the photography and social-media sector, it maintains accounts that link personal identifiers with login credentials. A breach at such a service is consequential because the data it holds can be reused across many other websites where individuals employ the same email address or password.

What data was at risk

The records reported as exposed contained email addresses, names, usernames, biographical text, and password hashes. Organisations of this type routinely store additional profile details and image metadata, yet the precise scope of every field accessed in this case remains unconfirmed beyond the categories already listed.

Why it matters

Email addresses combined with password hashes can be tested against other online services, increasing the chance that accounts belonging to the same individuals will be accessed without their knowledge. Names and biographical information add context that can support more convincing social-engineering attempts. For the organisation, the event highlights the long-term costs of storing user credentials and the difficulty of containing data once it has left its original environment.

If your data was in this breach

Begin by changing the password on your EyeEm account and on any other service where the same password or a close variation was used. Enable multi-factor authentication wherever it is offered. You can run a free exposure scan of your email address against known breach data to check whether your information appears in additional incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.