Flickr has started notifying users about a recent security incident tied to a third-party email service provider it works with. Importantly, Flickr says this was not a breach of its own servers, but rather a vulnerability in the external system used to send emails.

What information may have been exposed

Based on Flickr’s notification and media reports, the data involved may include:

• Usernames and real names
• Email addresses
• IP addresses
• Activity-related data (basic metadata about how users interact with the platform)

So far, there’s no indication that passwords, payment details, or other highly sensitive financial information were compromised.

What’s still unclear

There are still some unanswered questions:

• Flickr has not named the third-party provider involved
• The number of affected users hasn’t been disclosed
• Flickr says it shut down access to the affected email system shortly after discovering the issue

Why this matters

Even limited data exposure can still create risks. Information like email addresses, usernames, and IPs can be used for:

• Targeted phishing or scam emails
• Social engineering attempts
• Credential-stuffing attacks, especially if passwords are reused elsewhere

Because of this, security experts recommend being extra cautious with unexpected messages in the coming weeks.

What users should do

To stay safe, users are encouraged to:

• Be alert for suspicious emails asking you to click links or confirm information
• Enable multi-factor authentication (MFA) on Flickr and other accounts
• Change passwords if you’ve reused them on multiple services