Promo Data Breach (2020): What Was Exposed & What To Do

Inside the incident

Promo, described publicly as the “World’s #1 Marketing Video Maker,” suffered a data breach that was subsequently shared on a hacking forum. The event was reported on 22 June 2020. The material comprised 22 million records containing almost 15 million unique email addresses together with names, genders, IP addresses and salted SHA-256 password hashes. The data set was later supplied to Have I Been Pwned by dehashed.com.

Precise details of when the intrusion occurred, how access was obtained, or the total number of individuals ultimately notified remain undisclosed in available reporting.

How a breach like this happens

Incidents involving online service providers commonly begin with the exploitation of remote access points such as web-application vulnerabilities, compromised administrative credentials or misconfigured cloud storage. Once initial access is achieved, attackers frequently move laterally to database servers that hold user account information. Extracted data is then packaged and distributed through forums or data-sharing channels, after which copies circulate among multiple parties.

The presence of salted password hashes indicates that the organisation had implemented a basic cryptographic control, yet the exposure of those hashes alongside other identifiers still permits offline attempts at reversal if users have chosen weak or reused passwords.

Promo and its sector

Promo operated a platform that enabled customers to create marketing videos. Organisations in the digital-marketing and creative-software sector routinely collect account details, contact information and usage metadata to support registration, billing and content delivery. A breach at such a service therefore touches both individual users and the businesses that rely on the platform for customer-facing material.

The information in question

The records released included email addresses, names, genders, IP addresses and salted SHA-256 password hashes. No further categories of data, such as payment-card details or free-text profile information, are named in the available reporting. The exact scope of any additional internal systems that may have been accessed is unconfirmed.

The real-world impact

Individuals whose email addresses and password hashes appeared in the data set face an elevated risk of credential-stuffing attacks against other services where the same password may have been used. IP addresses and names can assist in targeted phishing or social-engineering attempts. For the organisation, the incident adds to the body of publicly discussed breaches that affect customer trust and may prompt regulatory or contractual review.

Because the data was circulated on forums, copies can persist indefinitely, making ongoing monitoring advisable for those potentially affected.

Were you affected?

Anyone who created an account with Promo can check whether their email address appears in this or other known incidents by running a free exposure scan on Have I Been Pwned or a comparable service. Practical next steps include changing the Promo password and any other account that used the same credential, enabling multi-factor authentication where available, and monitoring for unusual login activity.

AICompiled with AI assistance from public sources and published under our editorial standards.