piZap, an online photo editing and design platform, suffered a data breach in approximately December 2017 due to a misconfiguration. The compromised data was not publicly surfaced until February 2019, when it appeared for sale on a dark web marketplace alongside data from several other breached platforms. The breach affected 41.8 million user accounts. The exposed data included email addresses, names, usernames, genders, geographic locations, and website activity. Users who logged in via Facebook had their linked social media profiles exposed. Those who registered directly on piZap had their passwords exposed as SHA-1 hashes, a weak hashing algorithm that can be reversed with modest effort. Together, this combination of profile data and cross-platform identifiers allows attackers to build detailed pictures of individual users. No class-action litigation or regulatory enforcement specific to this breach has been documented. piZap did not make prominent public disclosures at the time the breach was discovered. Affected users face ongoing risks of account takeover, credential stuffing, and targeted phishing, particularly if they reused their piZap password on other services.

Web-based design platforms collect user accounts, emails, project metadata, billing records, and usage activity tied to casual creative workflows.

piZap continues to operate as a free photo editing tool. No major organizational changes have been publicly reported in the period surrounding or following the breach.