AI service Cutout.Pro suffers data breach exposing 20 million users' personal information

Cutout.Pro, an AI-powered photo and video editing platform renowned for its image enhancement and background removal services, has fallen victim to a significant data breach, compromising the personal details of approximately 20 million users. The breach, disclosed by an individual using the alias ’KryptonZambie’ on the BreachForums hacking forum, has raised concerns over the security of user information on the platform.

The exposed data in CSV files totaling 5.93 GB includes sensitive information such as email addresses, hashed and salted passwords, IP addresses, and user names. This extensive breach not only jeopardizes the privacy of Cutout.Pro’s vast user base but also raises questions about the platform’s security measures and data protection protocols.

According to reports, the cybercriminal behind the breach claimed ongoing access to Cutout.Pro’s system indicates a persistent security threat that the platform may not have fully addressed. The leaked data, comprising 41.4 million records with 20 million unique email addresses, underscores the severity of the breach and the potential impact on affected users.

Cybersecurity experts ’ analysis of the leaked data revealed a comprehensive range of personal information, including user IDs, profile pictures, API access keys, account creation dates, and even mobile phone numbers. The breach also exposed users’ account types and statuses, amplifying concerns regarding identity theft and fraudulent activities.

The gravity of the situation was further underscored by the inclusion of MD5 password hashes in the leaked dataset, known to be susceptible to modern cracking techniques. While Cutout.Pro has yet to officially confirm the security incident, but independent verification by renowned breach monitoring service Have I Been Pwned (HIBP) corroborates the authenticity of the breach. Founder Troy Hunt confirmed multiple matches from the leaked email addresses, indicating a significant breach affecting a substantial portion of the platform’s user base.