Fotolog Data Breach (2018): What Was Exposed & What To Do

Breaking down the breach

The breach was reported on December 1, 2018. Records indicate that 16.7 million unique email addresses were exposed, together with usernames and unsalted SHA-256 password hashes. No further details on the timing, method of access, or total number of files involved have been disclosed. The site itself was dissolved the following year and later repurposed as a news website based in Brcko, Bosnia and Herzegovina.

How a breach like this happens

Incidents involving the exposure of email addresses, usernames, and password hashes often stem from unauthorised access to an organisation’s user database. Attackers may exploit vulnerabilities in web applications, obtain credentials through phishing, or leverage misconfigured servers to extract stored data. Once obtained, the information can be distributed or sold without the knowledge of the affected service.

Password hashes that are unsalted are particularly straightforward to process with modern hardware, as each hash can be tested against common password lists independently. This type of exposure does not require the attacker to reverse the hash function in real time if the original passwords were weak or reused.

About Fotolog

Fotolog operated as a photo-sharing social network that allowed users to create accounts, upload images, and interact with other members. Services of this kind routinely collect email addresses for account registration and recovery, usernames for identification, and passwords to control access. When such a platform holds millions of records and later ceases operations, the data can remain available to third parties long after the original service has ended.

The information in question

The breach record identifies three categories of data: email addresses, usernames, and passwords stored as unsalted SHA-256 hashes. The exact contents of any individual record beyond these fields remain unconfirmed in public reporting.

Why it matters

Email addresses and usernames can be used to target individuals with further attempts to gain access to other accounts, especially where the same credentials or similar patterns were reused. Password hashes, even when not immediately reversed, provide attackers with material that can be processed offline over time. For a service that no longer exists, affected users have no direct channel to request account deletion or password resets from the original operator.

Were you affected?

Individuals can take the following steps to limit further exposure:

• Change passwords on any accounts that reuse the same or similar credentials.
• Enable multi-factor authentication where available.
• Monitor email accounts for unexpected login attempts or password-reset requests.

Readers may also run a free exposure scan of their email address against known breach data to determine whether their information appears in public records of this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.