Promo promo.com Promo data breach: what happened and what to do
Promo, a marketing video maker, was breached in July 2020. About 14.6 million accounts had email addresses, names, IP addresses, genders and salted SHA-256 password hashes exposed. Promo says no financial data was involved.
View all 13,115 breaches- Breach date
- 22 Jun 2020
- Affected
- 14,610,585
- Data exposed
- Email addresses, Genders, IP addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Promo.com is a marketing video maker, run by the same company as Slidely. In July 2020 a database of its users was shared on a hacking forum. Have I Been Pwned (HIBP) counts 14,610,585 unique email addresses, from about 22 million records.
What was exposed
The records contain email addresses, names, IP addresses, genders and passwords stored as salted SHA-256 hashes. Salting makes each hash unique, but SHA-256 is fast, so weak passwords can still be guessed.
What Promo said
Promo's breach FAQ says a vulnerability in a third-party service exposed non-financial Slidely and Promo user data, and that the company learned of it on July 21, 2020. It says no credit card or billing information was exposed and that logins through social media were not affected. Promo said it removed the vulnerable service and brought in a cybersecurity firm to improve intrusion detection.
What it lets criminals do
A name and email address are enough for phishing that looks like a message from a video tool or a business account. If you used the same password on other sites, a cracked hash can open them.
What to do
Change your Promo password and any reused copies, and be cautious with unexpected emails about your account or video exports.
What to do if you were in it
- 1
Change your Promo password
Go to the account settings and pick a new password. If the site is gone or you no longer use it, you can skip this step. If you signed in with a social account instead, there is no Promo password to change.
- 2
Change it everywhere you reused it
Look through your password manager or browser for logins that share the old password and replace each one, starting with email, banking and shopping accounts. Use a different password for every site.
- 3
Turn on two-factor authentication
Use an authenticator app or a hardware key on your email and any account that holds money or personal details. A stolen password alone then isn't enough to get in.
- 4
Expect phishing that uses your email address
Treat unexpected messages about your account, a prize or a password reset with suspicion. Don't click links in them: type the site address yourself or use its app.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan on the email addresses and phone numbers you use. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next leak without checking by hand.
Frequently asked
Was I affected by the Promo breach?
If you had a Promo or Slidely account in 2020, possibly. Search your email on HIBP to check.
What was exposed in the Promo breach?
Email addresses, names, IP addresses, genders and salted SHA-256 password hashes.
Was payment information exposed?
Promo says no financial data such as credit card or billing details was involved.
Should I change my password after the Promo breach?
Yes, and on any site where you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
