I didn't get an email… I found out from 500px's official Twitter account

1/2 PLEASE NOTE: We recently learned of a potential security issue and have taken every precaution to ensure our users' data is safe. There is no indication of unauthorized account access, but as a precautionary measure, we are resetting all user passwords.

An email notification will include more details on this specific issue, but you can learn more on our Support page

So what now? I didn't get an email, so I logged in and waited to see what would happen. A page appeared with a message along the same lines as above and a field to enter my registered email. I entered it and waited, then clicked reset password. I verified with the second factor — which, by the way, isn't required for logging in, only for the security section. I changed the password and confirmed it worked. Done.

Looking at it through the eyes of someone who works in security… there's room for improvement. First of all, not everyone was notified. The password reset process wasn't completely functional — the server was returning 502 errors. And last but not least, MD5 — this was exactly the moment when they should have switched the algorithm to bcrypt… These are details, but they're significant ones. Hopefully 500px won't lose users over this — that would be a shame.

Update 14.2 — it wasn't until today, at 15:14, that the official notice of the breach landed in my email… better late than never!