Imgur LLC

Summary

A security breach affecting 1.7 million user accounts occurred when unauthorized access compromised email addresses and passwords. The incident was discovered after a security researcher alerted the company, prompting immediate investigation confirming the intrusion. Compromised credentials were protected with an older hashing algorithm susceptible to brute-force attacks, though no personally identifiable information was exposed as the platform never collected such data. Impacted users received notifications and were required to reset passwords, while the company enhanced security measures by migrating to a stronger encryption standard. An internal review of systems and processes was initiated following the breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 23, 2017, Imgur was alerted to a potential security breach by a security researcher who claimed to possess data containing Imgur user information. The company's Chief Operating Officer received the notification late that evening and immediately engaged the researcher to gather details while simultaneously informing the Founder/CEO and Vice President of Engineering. By the early morning of November 24, forensic analysis confirmed that approximately 1.7 million user accounts had been compromised during a 2014 intrusion. The exposed data consisted solely of email addresses and hashed passwords, as Imgur historically did not collect real names, physical addresses, phone numbers, or other personally identifiable information. The breach remained undetected for approximately three years until external disclosure. Initial investigation indicated the attackers potentially cracked the SHA-256 encrypted passwords through brute-force methods, though the exact intrusion vector remained under active review at the time of disclosure. Imgur had proactively upgraded its password hashing algorithm to bcrypt in 2016, prior to discovering this historical breach.

Imgur initiated user notifications and containment measures on November 24, 2017. Impacted accounts received direct emails instructing mandatory password resets, while the company issued a public breach disclosure at 4 PM PST the same day. The response included immediate credential rotation requirements for compromised accounts and launched an internal security review of systems and procedures. No evidence suggested ongoing unauthorized access stemming from the 2014 incident at the time of disclosure. The company acknowledged the breach's occurrence and apologized for resulting inconveniences, directing inquiries to a dedicated support email address. No financial, biometric, or government-issued identification data was involved given Imgur's limited data collection practices.

Sources

Sources available to members: 1 source.