Photo-sharing platform Flickr is notifying users of a potential data breach after a vulnerability at a third-party email service provider exposed their real names, email addresses, IP addresses, and account activity.

Founded in 2004, Flickr is one of the world’s largest photography communities and sharing sites, hosting over 28 billion photos and videos. The company says it has 35 million monthly users and 800 million monthly page views.

Flickr did not disclose which third-party provider was involved or how many users were potentially affected by this incident. A Flickr spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today for more details.

The company said that it shut down access to the affected system within hours after being informed of the security flaw on February 5. While the vulnerability “may have” provided access to some member information, Flickr said that passwords and payment card numbers were not compromised in the incident.

“On February 5, 2026, we were alerted to a vulnerability in a system operated by one of our email service providers,” the company said in emails to affected users. “This flaw may have allowed unauthorized access to some Flickr member information. We shut down access to the affected system within hours of learning about it.”

The exposed information includes member names, email addresses, Flickr usernames, account types, IP addresses, general location data, and their activity on the platform.

The company has also encouraged affected users to review their account settings for any unexpected changes and to remain vigilant against phishing emails that may use their Flickr account information, noting that it will never request passwords over email.

Users are also recommended to update their passwords as soon as possible if they use their Flickr credentials on other services.

“We sincerely apologize for this incident and for the concern it may cause,” Flickr added in the emailed notifications.

“We take the privacy and security of your data extremely seriously, and we are taking immediate action to prevent any similar issues by conducting a thorough investigation, strengthening our system architecture, & further enhancing our monitoring of third-party service providers.”