{"id":"flickr-email-provider-flaw-member-data-feb-2026","category":"breach","status":"closed","title":"Flickr warns members a flaw at its email provider may have exposed names, emails and locations","tldr":"Flickr says a flaw in a third-party email provider's system may have exposed members' names, emails, usernames, IP addresses, locations and activity. No passwords or card numbers. Watch for phishing that mentions your Flickr account; change reused passwords.","summary":"Flickr told members in early February 2026 that a vulnerability in a system run by one of its email service providers may have allowed unauthorised access to some member information. Flickr says it was alerted on 5 February and shut down access to the affected system within hours. The information that may have been exposed is names, email addresses, usernames, account types, IP addresses, general locations and activity on the platform, and it varies by account. Flickr says passwords and payment card details were not affected. It removed links to the vulnerable endpoint, asked the provider to investigate, said it is strengthening its controls over third-party providers, and told data protection authorities. Flickr has not named the provider or said how many members were affected, and it has not said whether anyone actually took the data. As of the sources read, no later public update was found, so the investigation's outcome is not known.","action":"No password change is needed for Flickr itself. Be wary of emails that mention your Flickr account, check your account settings for unexpected changes, and change the password anywhere else you reused your Flickr one.","product":"Flickr photo-sharing service (member data held by a third-party email provider)","audience":"home","severity":"medium","patch":"na","exploited":false,"cves":[],"tags":["flickr","smugmug","data-breach","third-party","email-provider","phishing"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"Flickr discloses potential data breach exposing users' names, emails","url":"https://www.bleepingcomputer.com/news/security/flickr-discloses-potential-data-breach-exposing-users-names-emails/amp/","by":"BleepingComputer","date":"2026-02-06"},{"kind":"news","title":"Flickr emails users about data breach, pins it on third party","url":"https://www.theregister.com/2026/02/06/flickr_emails_users_about_data_breach/","by":"The Register","date":"2026-02-06"},{"kind":"news","title":"Flickr moves to contain data exposure, warns users of phishing","url":"https://securityaffairs.com/?p=187753","by":"Security Affairs","date":"2026-02-09"},{"kind":"news","title":"Flickr security incident tied to third-party email system","url":"https://www.securityweek.com/flickr-security-incident-tied-to-third-party-email-system/","by":"SecurityWeek","date":"2026-02-06"}],"started":"2026-02-06","closed":"2026-02-09","created":"2026-11-03T22:01:12.836Z","updated":"2026-11-03T22:01:12.836Z","cve_notes":[],"timeline":[{"at":"2026-02-09","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Security Affairs reported the same account: links to the vulnerable endpoint removed, the provider asked for a full investigation, and Flickr reviewing its controls over third-party services. No update on numbers or the provider had been published.","url":"https://securityaffairs.com/?p=187753","by":"Security Affairs","patch":"na"},{"at":"2026-02-06","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Flickr emailed members that the flaw may have exposed names, email addresses, usernames, account types, IP addresses, general locations and activity. It said passwords and payment card details were not affected, and that it had told data protection authorities. It did not name the provider or say how many members were affected.","url":"https://www.bleepingcomputer.com/news/security/flickr-discloses-potential-data-breach-exposing-users-names-emails/amp/","by":"BleepingComputer","patch":"na"},{"at":"2026-02-05","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Flickr says it was alerted to a vulnerability in a system run by one of its email service providers, and shut down access to that system within hours.","url":"https://www.theregister.com/2026/02/06/flickr_emails_users_about_data_breach/","by":"The Register","patch":"na"}],"url":"https://hard.fyi/live/flickr-email-provider-flaw-member-data-feb-2026/","json":"https://hard.fyi/api/live?id=flickr-email-provider-flaw-member-data-feb-2026"}