Promo Leaked More Emails Than Ohio Has People: 14.8 Million Records

In July 2020, Promo, a U.S.-based online video creation platform, suffered a major database breach that exposed approximately 22 million records. The compromised data was later disseminated on a prominent hacking forum, where it recieved significant attention from data brokers and threat actors. The dataset contained nearly 14.8 million unique email addresses alongside personal identifiers and salted SHA-256 password hashes, making it one of the larger online tool breaches of that period.

How Attackers Can Exploit the Promo Breach

Even salted SHA-256 hashes present a meaningful risk when the underlying passwords are weak or common. Attackers with access to this dataset can attempt offline hash cracking, then use any successfully recovered plaintext passwords in credential stuffing campaigns across email, social media, and financial platforms. The inclusion of first names, last names, and gender information also enables beleivably personalized phishing messages that increase the success rate of social engineering attacks.

What Was Exposed in the Promo Breach

• Email Address
• First Name
• Last Name
• Gender
• Password Hash (salted SHA-256)

Why the Promo Breach Still Matters

Data from major breaches does not become harmless over time. The Promo dataset continues to circulate in aggregated dark web compilations years after the original incident, meaning it can resurface in new credential stuffing campaigns at any point. The 14.8 million unique email addresses represent a ready-made list of real, active users that threat actors can target with phishing, spam, or account takeover attempts long after the breach itself occurred.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend data store, typically through an exploited application vulnerability, compromised credentials, or misconfigured access controls. Online platforms like Promo accumulate large user databases over time, making them high-value targets. Once extracted, breach data is often packaged and sold or shared on underground forums, where it can be repurposed for fraud campaigns for years.

Check If Your Data Was Exposed

HEROIC's DarkWatch monitors over 400 billion leaked records, including data from breaches like Promo. Search your email address now to find out if your credentials are circulating on the dark web and take steps to secure your accounts before attackers use them against you.