piZap Data Breach (2017): What Was Exposed & What To Do

In December 2017, the online photo editing service piZap experienced a data breach that exposed information associated with approximately 41.8 million user accounts. The incident came to wider attention when the data appeared for sale on a dark web marketplace in February 2019, bundled with other breach collections. Public records indicate that the exposed records included email addresses along with names, genders, geographic locations, usernames, website activity, links to social media profiles, and passwords stored as SHA-1 hashes for accounts created directly on the site.

What happened

The breach affected the piZap platform, which allows users to edit photos and, at the time, offered the option to sign in through Facebook. Records show that roughly 42 million unique email addresses were present in the data set. When users authenticated via Facebook, the records contained links to those profiles rather than stored passwords. For accounts created directly on piZap, the passwords were included as SHA-1 hashes. The exact date and method of the initial intrusion remain undisclosed in available reports.

How a breach like this happens

Incidents involving online service providers often begin with unauthorized access to user databases through compromised credentials, unpatched software, or misconfigured access controls. Once inside, an actor can copy large volumes of account information and later attempt to monetize it by offering the data on underground marketplaces. In many cases the original compromise occurs months or years before the data surfaces publicly, making precise timelines difficult to establish without forensic details from the affected organization.

About piZap

piZap operates as an online photo editing platform that permits users to create accounts either directly or through third-party social logins. Services of this type routinely store identifiers such as email addresses, usernames, and profile links, along with activity logs and, where applicable, hashed credentials. A breach at such a site can therefore reveal both personal contact details and indicators of online behavior across a large user base.

What data was at risk

The following data elements were reported in connection with the incident:

• Email addresses
• Names
• Genders
• Geographic locations
• Usernames
• Website activity
• Links to social media profiles
• Passwords stored as SHA-1 hashes (for non-Facebook accounts)

Exact confirmation of every field for every record has not been published.

The real-world impact

Individuals whose information appeared in the data set face the possibility that their email addresses and associated details could be used for targeted phishing or that reused passwords could be tested against other accounts. Organizations holding similar user data may face regulatory scrutiny and costs associated with notifying users and improving security controls. Because the data later circulated on underground markets, the window for potential misuse extends beyond the original compromise date.

If your data was in this breach

Review any piZap account you may have created and change the password if it is still in use elsewhere. Enable multi-factor authentication on accounts that support it and monitor incoming email for unusual messages. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.