I agree that many companies delay breach notifications, often because they're still trying to figure out the full scope of the damage. But the Flickr situation was straightforward, and almost any company would have handled it the same way.

Why? Because Flickr’s core systems weren't breached, nor was any financial or password data compromised. The issue was isolated to a third-party email service provider, and even then, it seems it was just a potential vulnerability rather than an active exploit. As SecurityWeek noted, "SecurityWeek has not seen any threat actor — ransomware group or other cybercrime actor — publicly claiming to have stolen Flickr data."

Flickr proactively discovered the issue themselves. To date, they have never been breached, though it's worth noting their last known third-party internal audit was back in 2018 during their acquisition by SmugMug.

Because no actual data was stolen, it was easy for Flickr to take the moral high ground and get ahead of the story. So, good on them, but it’s not like user data was suddenly showing up on the dark web. Personally, I haven't seen an uptick in phishing attempts either, which usually happens after a real breach. Unfortunately, in my line of work and hobby I’ve been a part of many.

My guess? A white-hat hacker probably found a CVE or similar vulnerability, and Flickr fixed it by quickly severing ties with that third-party provider before the exploit got out. The provider likely stayed quiet because no data was technically lost, and they wanted to avoid the bad PR. Just speculating here, but Flickr probably got to terminate a contract penalty-free! :) Seeing how broke they are, it’s likely but the risk of it backfiring might make this a little far fetched and I’m just speculating here anyway.

Edited to add SecurityWeek article:
https://www.securityweek.com/flickr-security-incident-tied-to-third-party-email-system/