Flickr warns members a flaw at its email provider may have exposed names, emails and locations
Flickr says a flaw in a third-party email provider's system may have exposed members' names, emails, usernames, IP addresses, locations and activity. No passwords or card numbers. Watch for phishing that mentions your Flickr account; change reused passwords.
No password change is needed for Flickr itself. Be wary of emails that mention your Flickr account, check your account settings for unexpected changes, and change the password anywhere else you reused your Flickr one.
What’s happening
Flickr told members in early February 2026 that a vulnerability in a system run by one of its email service providers may have allowed unauthorised access to some member information. Flickr says it was alerted on 5 February and shut down access to the affected system within hours. The information that may have been exposed is names, email addresses, usernames, account types, IP addresses, general locations and activity on the platform, and it varies by account. Flickr says passwords and payment card details were not affected. It removed links to the vulnerable endpoint, asked the provider to investigate, said it is strengthening its controls over third-party providers, and told data protection authorities. Flickr has not named the provider or said how many members were affected, and it has not said whether anyone actually took the data. As of the sources read, no later public update was found, so the investigation's outcome is not known.
- What
- Breach
- Affects
- Flickr photo-sharing service (member data held by a third-party email provider)
- Fixed in
- Nothing to patch
- Since
- 6 Feb 2026
- Closed
- 9 Feb 2026
Timeline
- UpdateNothing to patch
Security Affairs reported the same account: links to the vulnerable endpoint removed, the provider asked for a full investigation, and Flickr reviewing its controls over third-party services. No update on numbers or the provider had been published.
- UpdateNothing to patch
Flickr emailed members that the flaw may have exposed names, email addresses, usernames, account types, IP addresses, general locations and activity. It said passwords and payment card details were not affected, and that it had told data protection authorities. It did not name the provider or say how many members were affected.
- Made publicNothing to patch
Flickr says it was alerted to a vulnerability in a system run by one of its email service providers, and shut down access to that system within hours.
Sources
- Flickr discloses potential data breach exposing users' names, emailsBleepingComputer · 6 Feb 2026
- Flickr emails users about data breach, pins it on third partyThe Register · 6 Feb 2026
- Flickr moves to contain data exposure, warns users of phishingSecurity Affairs · 9 Feb 2026
- Flickr security incident tied to third-party email systemSecurityWeek · 6 Feb 2026