In October 2013, the company reported that hackers had stolen nearly 3 million encrypted customer credit card records, plus login data for an unknown number of user accounts. Later the company said the attackers had accessed IDs and encrypted passwords for 38 million “active users”.
The data was dumped online and user passwords were almost immediately cracked and reversed back to their plaintext versions. Security researchers challenged the initial reporting stating that the posting “appears to include more than 150 million username and hashed password pairs taken from Adobe".
After weeks of research, it eventually turned out, as well as the source code of several Adobe products, the hack had also exposed customer names, IDs, passwords and debit and credit card information.
The incident has since served as an example to push for the adoption of strong password hashing functions.
In August 2015, an agreement called for Adobe to pay a $1.1 million in legal fees and an undisclosed amount to users to settle claims of violating the Customer Records Act and unfair business practices. In November 2016, the amount paid to customers was reportedly $1 million.
Want to discuss this case? You can purchase a 30 minute conference call with our analysts to discuss this case and the implications it has for your organisation. Just select the time and date that works for you:
We've done the analysis so you can make the decisions