Cutout.Pro Data Breach (2024)

On February 26, 2024, 20 million Cutout.Pro users learned that their accounts had been exposed in a breach first catalogued by Have I Been Pwned. The AI-powered visual design platform, used by individuals and small creative businesses worldwide, had its database compromised sometime prior, with the stolen material — including email addresses, names, IP addresses, and salted MD5 password hashes — later distributed on a popular hacking forum and across Telegram channels.

Confirmed Breach Details

The primary disclosure on Have I Been Pwned states that the incident occurred in February 2024 and affected approximately 20 million records. Exposed information includes full names, email addresses, IP addresses, and passwords stored as salted MD5 hashes. The listing does not specify the exact intrusion method or whether the attacker achieved initial access through a vulnerability, stolen credentials, or misconfigured cloud storage. It also does not indicate whether any ransom was demanded or paid. The data was not limited to a single system; the breach appears to have reached the central user database that powers account logins and profile information across the platform.

Why This Matters for You and Your Family

If you have ever used Cutout.Pro to remove backgrounds from images, generate design assets, or create marketing visuals, your real name, email, and password hash are now in circulation. Salted MD5 hashes, while not plaintext, can still be cracked with modest computing resources, especially when users rely on common passwords. An exposed IP address further narrows down your likely geographic location at the time of registration or last login. For families, this risk multiplies when the same email or password is reused for online shopping, children’s school accounts, or family photo storage. Once criminals obtain even partial identity details, they can combine them with information from earlier breaches to build a more complete picture of your household.

Doxxing and Identity-Chain Risks

The combination of name, email, IP address, and cracked password creates a classic starting point for doxxing chains. Attackers can correlate the Cutout.Pro email with gaming accounts, social-media handles, or shopping profiles that share the same password or recovery address. A single cracked password often leads to account takeover on other services, which then yields home addresses, phone numbers, or linked payment methods. Children’s gaming accounts are particularly vulnerable because parents frequently reuse credentials across adult creative tools and family-oriented platforms. The public distribution on hacking forums and Telegram means multiple actors now have access, increasing the chance that your information will surface in targeted harassment, identity theft, or spear-phishing campaigns months or even years later.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate the password you used at Cutout.Pro anywhere it is reused and switch to a unique passphrase for every account; enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and 100-plus platforms so the next exposure is caught in hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same email or address.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak sites on your behalf.

The Cutout.Pro breach is a reminder that even creative tools many families use without a second thought can become gateways to larger identity compromises. Staying ahead requires more than changing one password. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next leak surfaces.