What Happened
In 2014, someone broke into Imgur and took about 1.7 million email addresses and passwords. Nobody knew for three years. Security researcher Troy Hunt, who runs the breach search site Have I Been Pwned, received a copy of the data and told Imgur on 23 November 2017. Imgur confirmed the breach the next day and started resetting passwords for the affected accounts.
Imgur stored those passwords with SHA-256, a fast hash that attackers can crack in bulk. The company had already switched to bcrypt, a much slower and safer method, in 2016. Imgur never asked users for real names, home addresses or phone numbers, so those were not in the leak.
Are You Affected?
If you had an Imgur account in 2014 or earlier, assume your email address and an old password are out there. Search your email address on Have I Been Pwned to see this breach and any others your address shows up in.
The real risk is not your Imgur account. It is every other account where you used the same password. Attackers feed leaked email and password pairs into login pages of banks, shops and email providers. This is called credential stuffing, and it works because most people reuse passwords.
What to Do Now
- Check your email address on Have I Been Pwned. Note every breach it lists, not only Imgur.
- Change every reused password, starting with your email account. Whoever controls your email can reset everything else.
- Use a password manager so every account gets its own long, random password. Our password manager comparison covers the best options for 2026.
- Turn on two-factor authentication for email, banking and social media. A leaked password alone then no longer gets someone in.
- Cut down what is already public. Data brokers combine leaks with public records. See how to remove yourself from the internet.
Would a VPN Have Helped?
No. This breach happened on Imgur's servers, and a VPN only protects your connection between your device and the internet. It cannot protect data a company already stores.
A VPN does help in a different situation: on hotel, cafe or airport networks, where someone on the same network can try to read your traffic. If that is you, read our guide to using a VPN on public Wi-Fi.
Ten minutes covers the risk from this breach and the next one: check your email, give every account its own password, and cut down what data brokers sell about you.