Software company hacked and 38 million accounts breached

Synopsis

The company initially reported that hackers had stolen nearly 3 million encrypted customer credit card records, plus login data for an unknown number of user accounts. Later the company said the attackers had accessed IDs and encrypted passwords for 38 million “active users”.

The data was dumped online and user passwords were almost immediately cracked and reversed back to their plaintext versions. Security researchers challenged the initial reporting stating that the posting “appears to include more than 150 million username and hashed password pairs taken from Adobe".

After weeks of research, it eventually turned out, as well as the source code of several Adobe products, the hack had also exposed customer names, IDs, passwords and debit and credit card information.

The incident has since served as an example to push for the adoption of strong password hashing functions.

In August 2015, an agreement called for Adobe to pay a $1.1 million in legal fees and an undisclosed amount to users to settle claims of violating the Customer Records Act and unfair business practices. In November 2016, the amount paid to customers was reportedly $1 million.

Speak to the analyst

Want to discuss this case? We're offering a FREE 20 minute phone consultation to discuss this case and the implications it has for your organisation. Just select the time and date that works for you:

Analyst

Courtenay Brammar

Experienced global enterprise risk and governance professional. Previously Vice President at Morgan Stanley, Deloitte Risk Advisory practitioner and PRMIA steering committee member in both London and New York.

Additional services

We offer a range of cost-effective, fixed-price training programmes and consultant services derived from the unique insights gained from all our case study data.

If you'd rather we did the heavy lifting in developing a cyber incident response plan or lessons learnt training for your organisation underpined by our unique insight into the challenges faced and strategies implemented by organisations countering today's cyber security threats then please contact us here.