Adobe Source Code and Customer Data Breach

What happened

Hackers breached Adobe's network and stole customer data and product source code. Initially reported as affecting 3 million users, the scope was later revised to 38 million active users and over 150 million total records. The stolen data included encrypted passwords and credit card records. Additionally, the attackers exfiltrated the source code for several of Adobe's flagship products.

Technical mechanism

The attackers accessed Adobe's internal network and databases. Analysis of the leaked password database revealed that Adobe had used Triple DES encryption in ECB mode for passwords, rather than a strong hashing algorithm with unique salts, allowing researchers to easily deduce many passwords through pattern analysis and frequency.

Why it matters

The theft of proprietary source code for widely used software raised significant concerns about the potential for discovering new zero-day vulnerabilities, while the massive exposure of user credentials highlighted the risks of weak password hashing practices.

Impact

The breach exposed the credentials of tens of millions of users, leading to credential stuffing attacks on other platforms. The theft of source code potentially aided malicious actors in finding vulnerabilities in Adobe products. Adobe offered free credit monitoring to affected customers.

Response

Adobe reset passwords for affected users, notified customers whose credit card information was compromised, and engaged law enforcement. The company faced a multi-state investigation and agreed to a $1 million settlement and implementation of stronger security practices.

Defensive lessons

• Use strong, modern hashing algorithms (like bcrypt or Argon2) with unique salts for storing passwords
• Implement robust access controls and monitoring for source code repositories
• Employ defense-in-depth strategies to prevent lateral movement after initial compromise

Evidence register

1. Adobe — Important Customer Security Announcement (verified)