Promo.com Data Breach Exposes 14.6 M Accounts and Password Hashes
What Happened — In July 2020 the marketing‑video SaaS platform Promo suffered a breach that was later posted on a hacking forum. The leak contained roughly 15 million unique email addresses together with names, genders, IP addresses and salted SHA‑256 password hashes, totaling 14.6 million compromised records.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection and the need for continuous monitoring of authentication controls.
- Highlights the importance of maintaining defensible evidence of password‑storage policies and audit‑ready logs to satisfy multiple frameworks (e.g., NIST CSF 2.0).
- Shows how a single control gap—weak password‑hash handling—can trigger large‑scale data exposure, underscoring the value of a control‑assurance program that validates access‑control safeguards.
Who Is Affected – SaaS providers in the marketing/creative tech space and their customers whose personal data were stored on the platform.
Recommended Actions – Review and harden password‑storage mechanisms (use strong, adaptive hashing, rotate salts), implement continuous credential‑access monitoring, and collect evidence of these controls for audit readiness. Source: HIBP breach record
Technical Notes – The breach was disclosed via a public forum; no specific vulnerability (CVE) was identified, and the exact attack vector remains unknown. Exposed data included email addresses, names, genders, IP addresses, and salted SHA‑256 password hashes. Source: HIBP breach summary