Inside the Profit Ad Links Breach: How 9,550 Records Were Compromised

In August 2018, Profit Ad Links, a now-defunct online advertising platform based in the United States, suffered a data breach that exposed 9,550 user records. HEROIC analysts confirmed the compromised data included email addresses and plaintext passwords, which later surfaced on a hacking forum where it became available to anyone looking for ready-to-use credentials. Because the passwords were never hashed, anyone who obtained the data did not need to do any cracking before putting it to use.

Why This Is Dangerous

Plaintext passwords are about as bad as it gets from a security standpoint. Most legitimate services hash passwords before storing them, which forces an attacker to do extra work before the data becomes usable. When passwords are stored in plaintext, a breach is immediately actionable, and someone can start testing those credentials against other websites within minutes of obtaining the file.

Because this data ended up on a hacking forum, it was broadly distributed rather than used by a single attacker. Forum members download and share datasets like this one, often folding them into larger combo lists used for automated credential stuffing.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

The platform itself is gone, but the consequences of this breach are still playing out. Databases like this one get merged into large combo lists and reused in automated attacks against major platforms years after the original incident. If you ever had an account on Profit Ad Links and reused that password anywhere else, that password should be treated as compromised. An exposed email address on its own also carries risk, since it can be used to target you with phishing or spam even without the password attached.

How Database Breaches and Combolists Work

A database breach typically happens when an attacker gains unauthorized access to a web application's backend, often through a vulnerability like SQL injection, a misconfigured server, or stolen administrative credentials. Once inside, an attacker can export an entire user database in a matter of seconds.

That stolen database often ends up on underground forums where it is sold or traded. Over time, breached databases from many different sources get merged together into what is known as a combolist, a large file of email and password pairs that gets loaded into automated tools and tested against popular online services. This is why a breach at a small, now-defunct platform like Profit Ad Links can still cause real harm years later. The data does not stay isolated. It becomes part of a much larger pool of credentials used in ongoing attacks.

Check If You Are Affected

If you ever had an account on Profit Ad Links or are simply unsure whether your email address has appeared in a known breach, check for free using HEROIC's breach checker at heroic.com. It searches more than 400 billion exposed records and can tell you in seconds whether your data has turned up in this or any other known leak.