Breach Disclosure: Promo

Breach Disclosure: Promo.com

Promo.com, a popular video maker and a cloud-based video creation service, was recently breached impacting over 22.1 million user records. This breach was posted on a popular hacking forum on 20 July 2020 and is available for sale at an undisclosed price. On 26 July 2020, the company confirmed the breach with a post on their website.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Promo.com (a.k.a. Promo by Slidely or previously Slide.ly) is a popular video maker and a cloud-based video creation service that is allowing the creation of videos from stock videos, stock photos, video clips, and music. On 20 July 2020, a threat actor posted the Promo leak on the dark web, claiming that the leak impacts over 22.1 million users (2.6 million with passwords).

Figure 1. Promo’s Database available for sale on a popular hacking forum

The leaked information includes:

• First name
• Last name
• Email addresses
• Genders
• General geographic locations
• IP addresses
• Passwords (encrypted, hashed, and salted)
• The threat actor has posted the sample data from the leak and is selling the entire database at an undisclosed price

Figure 2. Sample Data posted by the threat actor selling Promo’s Database