Cutout.Pro cutout.pro Cutout.Pro data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In February 2024, AI design platform Cutout.Pro was breached. Have I Been Pwned lists 19,972,829 accounts, with email addresses, IP addresses, names and salted MD5 password hashes exposed, later spread on hacking forums and Telegram channels.
View all 13,118 breaches- Breach date
- 26 Feb 2024
- Affected
- 19,972,829
- Data exposed
- Email addresses, IP addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Cutout.Pro is an AI-powered visual design platform. In February 2024 it suffered a data breach. Have I Been Pwned (HIBP) lists 19,972,829 accounts and added them on 28 February 2024. HIBP says the data was broadly distributed on a popular hacking forum and Telegram channels, so many people have likely had access to it.
Sources checked: haveibeenpwned.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Email addresses, IP addresses, names and passwords stored as salted MD5 hashes. HIBP lists no phone numbers or payment details.
What it means for you
Names and email addresses are enough for targeted phishing, for example a fake message about your Cutout.Pro account. The password hashes were widely shared, which raises the odds that weak or reused passwords get cracked and tried on other sites.
The company's response
HIBP's entry is the public record, and it links no company notice. If Cutout.Pro contacts you about the breach, read the message on the company's own site rather than clicking its links. The hashes were spread widely, so act on your passwords rather than waiting for a notice.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If you used your Cutout.Pro password on any other account, change it there now, and use a different password for each account. A password manager makes that easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your important accounts, starting with email. It blocks most takeovers even when a password has leaked. The FTC lists this among its post-breach steps.
- 3
Expect scam messages
With your name and email address out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 4
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the Cutout.Pro breach?
Search your email on Have I Been Pwned. If CutoutPro is listed, you were among the 19,972,829 accounts.
What was exposed in the Cutout.Pro breach?
Email addresses, IP addresses, names and salted MD5 password hashes, per HIBP.
Should I change my password?
Yes, on Cutout.Pro and anywhere you reused it. The hashes were widely distributed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
