Adobe Inc. significant event Adobe Systems 2013 data breach
Customer data breach
On October 3, 2013, the company initially revealed that 2.9 million customers' sensitive and personal data was stolen in a security breach which included encrypted credit card information. Adobe later admitted that 38 million active users have been affected and the attackers obtained access to their IDs and encrypted passwords, as well as to many inactive Adobe accounts. The company did not make it clear if all the personal information was encrypted, such as email addresses and physical addresses, though data privacy laws in 44 states require this information to be encrypted.A 3.8 GB file stolen from Adobe and containing 152 million usernames, reversibly encrypted passwords and unencrypted password hints was posted on AnonNews.org. LastPass, a password security firm, said that Adobe failed to use best practices for securing the passwords and has not salted them. Another security firm, Sophos, showed that Adobe used a weak encryption method permitting the recovery of a lot of information with very little effort. According to IT expert Simon Bain, Adobe has failed its customers and 'should hang their heads in shame'.Many of the credit cards were tied to the Creative Cloud software-by-subscription service. Adobe offered its affected US customers a free membership in a credit monitoring service, but no similar arrangements have been made for non-US customers. When a data breach occurs in the US, penalties depend on the state where the victim resides, not where the company is based.After stealing the customers' data, cyber-thieves also accessed Adobe's source code repository, likely in mid-August 2013. Because hackers acquired copies of the source code of Adobe proprietary products, they could find and exploit any potential weaknesses in its security, computer experts warned. Security researcher Alex Holden, chief information security officer of Hold Security, characterized this Adobe breach, which affected Acrobat, ColdFusion and numerous other applications, as "one of the worst in US history". Adobe also announced that hackers stole parts of the source code of Photoshop, which according to commentators could allow programmers to copy its engineering techniques and would make it easier to pirate Adobe's expensive products.Published on a server of a Russian-speaking hacker group, the "disclosure of encryption algorithms, other security schemes, and software vulnerabilities can be used to bypass protections for individual and corporate data" and may have opened the gateway to new generation zero-day attacks. Hackers already used ColdFusion exploits to make off with usernames and encrypted passwords of PR Newswire's customers, which has been tied to the Adobe security breach. They also used a ColdFusion exploit to breach Washington state court and expose up to 200,000 Social Security numbers.