Breach Disclosure: 500px

On February 8th 2019, 500px Support discovered a security breach that resulted in unauthorized access of user profile data. The investigation showed that on July 5th, 2018, an unauthorized party gained access to 15M unique email addresses, usernames, first and last names, gender, dates of birth, city, country and MD5 or bcrypt password hashes. 500px is resetting all users' account passwords as a safety measure.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

500px is number 8 out of the 16 breaches from The Register report that have been disclosed to the public. User data present in 500px systems prior to July 5th was compromised. The investigation made by 500px was coordinated with law enforcement authorities and a third-party expert on the subject. The official announcement of 500px was made on February 13th, 2019, because they waited until it was assured that the systems was secured and the users' data was not accessed without authorization. According to ExtremeTech, the stolen data is useless to access the affected accounts, but personally identifiable information was exposed regardless.