Inside the Profit Ad Links Breach: How 9,550 Records Were Compromised

In August 2018, Profit Ad Links, a now-defunct online advertising platform based in the United States, suffered a data breach that exposed nearly 9,550 user records. The compromised data later turned up on a well-known hacking forum, where it was made available to anyone looking for ready-to-use credentials. What makes this incident worth paying attention to even years later is that the passwords were stored in plaintext, meaning anyone who recieved the data didn't have to do any cracking to start using it.

Why This Is Dangerous

Plaintext passwords are about as bad as it gets from a security standpoint. Most legitimate services hash passwords before storing them, which at least forces attackers to do extra work before they can use the data. When passwords are stored in plaintext, the breach is immediately actionable. Someone can grab the file and start testing those credentials against other websites within minutes.

The fact that this data ended up on a hacking forum means it was broadly distributed, not just used by a single attacker. Forum members download and share these datasets, often incorporating them into larger combolists used for automated credential stuffing campaigns. Even if Profit Ad Links is no longer operating, the email and password pairs it once held are still in circulation.

People who used this platform and reused their password on other accounts are still at risk today. Data from 2018 doesn't expire, and credential stuffing tools don't discriminate based on how old the breach is.

What Was Exposed

• Email addresses
• Plaintext passwords
• User account identifiers
• Platform login credentials
• Potentially linked advertising account details
• Registration metadata such as usernames or account names

Why This Matters

The platform may be gone, but the damage from this breach is still playing out. Databases like this one get bundled into massive combolists and used in automated attacks against major platforms. If you had an account on Profit Ad Links and used the same password anywhere else, that password should be considered compromised.

It's also worth noting that email addresses themselves have value beyond just logging in. An email adress pulled from a breach can be used for targeted phishing, spam campaigns, or social engineering. The combination of a verified email and a working password is particularly dangerous because it confirms the account was real and active.

How Database Breach and Combolist Works

A database breach typically happens when an attacker gains unauthorized access to a web application's backend, usually by exploiting a vulnerability like SQL injection, a misconfigured server, or stolen admin credentials. Once inside, they can export the entire user database in a matter of seconds.

That stolen database then often makes its way to underground forums where it's sold or traded. Over time, multiple breached databases get merged together into what's called a combolist, a massive file containing millions of email and password pairs from various sources. These lists are then loaded into automated tools that systematically test the credentials against popular services.

This is why a breach at a small, obscure platform like Profit Ad Links can still cause real harm. The data doesn't stay isolated. It gets absorbed into the broader ecosystem of stolen credentials and used in attacks against Gmail, Netflix, banking apps, and corporate networks for years after the original breach occured.

Check If You Were Affected

If you ever had an account on Profit Ad Links or are worried your email address has appeared in other breaches, you can check for free using HEROIC's breach lookup tool at heroic.com. Enter your email and HEROIC will instantly show you whether your data has been found in any known breach database.