123RF 123rf.com 123RF data breach: what happened and what to do
In March 2020, the stock photo site 123RF had a breach that hit over 8 million subscribers. The data included email, IP and physical addresses, names, phone numbers, usernames and passwords stored as MD5 hashes, and it was sold online.
View all 13,177 breaches- Breach date
- 22 Mar 2020
- Affected
- 8,661,578
- Data exposed
- Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
123RF, a stock photo and image site, had a data breach in March 2020. Have I Been Pwned (HIBP) counts about 8.7 million accounts.
What happened
The data was sold online. 123RF told users and authorities that its database had been accessed through its data center and that membership data was copied. The company said the most recent data appeared to have left its systems on 22 March 2020.
Sources checked: haveibeenpwned.com, bleepingcomputer.com, hackread.com
Last verified against the official page:
What was exposed
HIBP lists email addresses, IP addresses, physical addresses, names, phone numbers, usernames and passwords stored as MD5 hashes. MD5 is weak. Common passwords crack fast under it, so assume yours could be known.
What it means for you
Reused your 123RF password elsewhere? Then those other accounts are at risk, and the quickest fix is a new password in each one. The mix of name, address and phone number is also handy for scammers, so be wary of emails or calls about subscriptions and invoices.
How to check your exposure
Search your email address on Have I Been Pwned, which holds this dataset and lets you look up an address for free. If it shows up, change the password wherever you shared it and turn on two-factor login. Unexpected invoice or renewal messages? Don't click them.
What to do if you were in it
- 1
Change your password and turn on 2FA
Set a new, unique password for 123RF. If you used that password anywhere else, change it there too, and turn on two-factor login on your important accounts. A password manager makes unique passwords easy.
- 2
Expect phishing and text scams that mention the breach
Treat unexpected emails, calls and texts that use your name, phone number or address with suspicion. Don't click links in them. Go to the company's site by typing the address yourself.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures early. It can't remove data from a breach, which is why the steps above matter.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the 123RF breach?
Check your email on Have I Been Pwned. If 123RF is listed, you were in the data.
What was exposed?
Email and IP addresses, physical addresses, names, phone numbers, usernames and MD5-hashed passwords.
Should I change my password?
Yes, on 123RF and anywhere you reused it. Turn on 2FA where it's offered.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- Page text rewritten in plainer language; no facts changed.
