SendPulse Data Breach Exposes 353,297 Accounts With Plaintext Passwords

A breach of SendPulse, the U.S.-based marketing automation platform that powers email, SMS, chatbot, and CRM campaigns for hundreds of thousands of businesses, has spilled 353,297 user records into underground channels. Each record pairs a login email with a plaintext password, a combination that goes from leak to account takeover without any cracking step in between.

Why This Marketing Platform Breach Is Dangerous

SendPulse is not a casual service. Its users are marketers, founders, and agency operators with direct access to customer contact lists, transactional email templates, and outbound SMS infrastructure. A compromised SendPulse account is a phishing launchpad: an attacker who logs in can send brand-correct emails from domains already warmed up with good sender reputation, pushing malware or credential-harvesting links to the account's real subscribers. That is an order of magnitude more dangerous than a generic breach of a personal consumer service.

What Was Exposed in SendPulse

• Email addresses used to sign in to SendPulse workspaces, often work emails tied to business domains
• Plaintext passwords stored without hashing, salting, or any cryptographic protection
• Workspace access potential for campaign tooling, contact lists, and outbound messaging
• 353,297 total records spanning SendPulse's global marketing customer base

Why This Matters

The plaintext password issue is the story. In 2025, storing user passwords in clear text is a security failure so basic that it raises immediate questions about every other control inside the affected system. If the password field was not hashed, what else was not encrypted? Customer contact lists? API keys for integrated services? Billing information? Even if SendPulse's broader posture is sound, the 353,297 users in this dataset must assume their credentials are burned, their campaigns are at risk, and every service where they reused that password is now one automated login attempt away from takeover.

How Database Breaches Work

SaaS platform breaches of this scale typically start with one of three root causes: an exposed admin interface or developer endpoint, a compromised employee credential to internal tooling, or a third-party integration that silently leaked database access. Once attackers establish a foothold, they move laterally until they find a user table, export it, and begin testing the credentials against high-value targets such as email providers, cloud consoles, and cryptocurrency exchanges. The SendPulse data appearing on April 2, 2025, is already past the initial private-trade phase and circulating to broader buyer pools.

Check If You Are Affected

If you or your team uses SendPulse for any marketing automation work, reset the SendPulse password immediately, rotate that password everywhere else it was reused, and rotate any API keys generated from the affected workspace. Search the HEROIC DarkHive database of 400 billion-plus records to confirm whether your email appears in the SendPulse breach and identify additional exposures tied to your accounts.