Popular image-sharing site Imgur Inc. has disclosed that it was hacked back in 2014, with the details of 1.7 million users stolen.

The hack was first detected by Troy Hunt of data breach notification service Have I Been Pwned, who had the stolen data sent to him last week. Hunt subsequently informed Imgur on Thursday that he was in possession of the data, prompting the company to launch an investigation into a hack that until that point it was completely unaware of.

“On November 23, Imgur was notified of a potential security breach that occurred in 2014 that affected the email addresses and passwords of 1.7 million user accounts,” Imgur Chief Operating Officer Roy Sehgal said in a blog post. “While we are still actively investigating the intrusion, we wanted to inform you as quickly as possible as to what we know and what we are doing in response.”

The passwords stolen in the hack were encrypted, but they used SHA-256, an older encryption standard that can easily be compromised using a brute-force attack. That means that for all intents and purposes, the passwords may well have been in plain text.

Hunt reacted positively to Imgur’s decision to go public quickly after being informed. “I disclosed this incident to Imgur late in the day in the midst of the US Thanksgiving holiday,” he told ZDNet. “That they could pick this up immediately, protect impacted accounts, notify individuals and prepare public statements in less than 24 hours is absolutely exemplary.”

Imgur is not the first image hosting site to be hacked and it probably won’t be the last. Others that have been targeted previously include competitor Photobucket.com Inc., which was hacked in 2015, and Flickr, whose accounts were compromised as part of the broader Yahoo hacks in 2014.

Image: Imgur/screenshot