What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Freepik Company disclosed on August 21, 2020 that a SQL-injection attack against Flaticon exposed email addresses belonging to its oldest 8.3 million users and password hashes for a subset. The affected accounts were on both Freepik and Flaticon. A password hash is not the plaintext password and, by itself, cannot be used to log in.
Was Freepik hacked?
Yes. Freepik Company said forensic analysis found that an attacker exploited a SQL-injection vulnerability in Flaticon and extracted user information. The company’s August 21, 2020 statement described the incident as affecting the oldest 8.3 million users of its Freepik and Flaticon services. SecurityWeek reported the disclosure on August 24, 2020 and independently summarized the SQL-injection explanation.
As an Amazon Associate I earn from qualifying purchases.
The available records document what the company reported in 2020. They do not establish the current status of any particular account or the later completion of long-term security work.
Recommended Free Tools
What information was exposed in the Freepik data breach?
Freepik said email addresses were extracted for all 8.3 million affected users and that password hashes were obtained where available. Its published subgroups were rounded, so they should not be treated as an exact partition of the total.
#1 Best Overall
| Account group | Information Freepik said was obtained | Freepik’s stated response |
|---|---|---|
| 4.5 million users (Freepik Company, 2020) | These users exclusively used federated login through Google, Facebook and/or Twitter. The company said only their email addresses were obtained. | Users were notified; Freepik said no special action was required for this group under its response. |
| 3.77 million users (Freepik Company, 2020) | Email addresses and password hashes. | Users with bcrypt hashes received an email suggesting a password change, particularly for weak passwords. Accounts with salted-MD5 hashes had their passwords cancelled and reset instructions sent. |
| 3.55 million users (Freepik Company, 2020) | Password hashes using bcrypt. | Password-change advice, especially where the password was easy to guess. |
| 229,000 users (Freepik Company, 2020) | Password hashes using salted MD5. | Passwords were cancelled and users were instructed to change them urgently, including on other sites where the same password had been reused. |
The 3.55 million and 229,000 figures total 3.779 million, while the company rounded the larger category to 3.77 million. Similarly, the rounded subgroups should not be added as though they were an exact mathematical breakdown of 8.3 million.
Were Freepik passwords leaked?
Freepik reported that password hashes, not readable plaintext passwords, were exposed for some users. The company stated: “To clarify, the hash of the password is not the password, and cannot be used to log into your account.” Hashing is a one-way transformation, but the practical risk depends on the hashing method, password strength and whether a password was reused elsewhere.
Bcrypt hashes
Freepik said 3.55 million users had bcrypt password hashes. It emailed those users a suggestion to change weak passwords. Bcrypt is designed to make large-scale password guessing more expensive than older fast-hash schemes, but a weak or reused password can still warrant replacement.
Salted-MD5 hashes
Freepik said 229,000 users had salted-MD5 hashes. It cancelled those passwords and sent urgent change instructions. Anyone who had reused one of those credentials on another service was specifically urged to change the password there as well.
What did Freepik say it did after the breach?
- It said all users’ password hashes were updated to bcrypt.
- It cancelled passwords associated with the salted-MD5 group and sent reset instructions.
- It emailed bcrypt users a recommendation to change weak passwords.
- It notified users whose email address alone had been exposed.
- It said it regularly checked leaked email-and-password combinations for matches to Freepik or Flaticon credentials and disabled matching passwords.
These are statements by Freepik Company about its response at the time, reproduced in the archived company statement and contemporaneous SecurityWeek coverage. The sources do not independently verify present-day implementation.
In its apology, Freepik Company wrote in Spanish: “Es cierto que ningún sistema es 100% seguro, sin embargo, esta situación no debería haber ocurrido y nos disculpamos por este incidente de seguridad.” The statement was issued by the company; no named executive or security officer was identified.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should I do if I had a Freepik account in 2020?
Do not assume that every former Freepik or Flaticon user needs a specific action today solely because of this 2020 disclosure. Check current account notifications and current guidance from the service for your own account.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
- If Freepik cancelled your password, set a new, unique password and change that same password anywhere else it was reused.
- If you used a weak password and received the company’s bcrypt notification, replace it with a long, unique password.
- If you used Google, Facebook or Twitter exclusively for sign-in, the company said your email address—not a Freepik password—was in the affected data for that group.
- Be alert for phishing messages using your exposed email address. Do not provide credentials through an unsolicited link.
- Freepik’s notice pointed users to Have I Been Pwned to check whether an email address or password appeared in a breach. A historical match there is not proof of your current Freepik account status.
What the 2020 disclosure establishes—and what it does not
- Established: Freepik Company publicly described a Flaticon SQL-injection incident on August 21, 2020, affecting Freepik and Flaticon users.
- Established: The company reported email exposure for its oldest 8.3 million users and password-hash exposure for a subset.
- Established: The company reported federated-login, bcrypt and salted-MD5 subgroups and described different notifications or password actions for each.
- Not established by these records: whether a particular reader’s account remains exposed, whether an attacker cracked any individual hash, or the eventual outcome of longer-term security plans.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
