Adobe Hacking Attack Was Bigger Than Previously Thought

An online attack at Adobe compromised personal data for tens of millions more customers than was previously reported, the company acknowledged on Tuesday.

Earlier this month, Adobe said that hackers had gained access to credit card information and other personal data for 2.9 million of its customers. The company said hackers had also stolen an undisclosed number of Adobe usernames and encrypted passwords. On Tuesday, that tally of stolen usernames and passwords had grown to more than 38 million records.

Adobe said that number included expired and invalid usernames and encrypted passwords, but did not give an exact count for how many were still active. Heather Edell, an Adobe spokeswoman, said the company had reset passwords for affected accounts and notified all 38 million affected users.

Previously, Adobe said hackers had also stolen source code to three of its most widely used products: Acrobat, ColdFusion and ColdFusion Builder, which are run on personal computers and business servers around the world. On Tuesday, Adobe acknowledged that part of the source code for Photoshop, its widely used photo editing software, had also been taken.

While Adobe said stolen passwords were encrypted, security experts say that encryption typically delays but does not outright prevent hackers from cracking passwords and selling them on auction-like black market sites where a single password can fetch $20.

To crack passwords, hackers regularly exploit extensive online databases of common passwords and as many as 50 million so-called hash values. Others will use “rainbow tables,” which list encrypted values for nearly every alphanumeric character combination up to a certain length.

“Cyberattacks are one of the unfortunate realities of doing business today,” Adobe's chief security officer, Brad Arkin, wrote in a blog post earlier this month. “Given the profile and widespread use of many of our products, Adobe has attracted increasing attention from cyberattackers.”

In a financial filing last September, Adobe acknowledged that the company was a regular target for online theft, and that loss of proprietary information could “result in litigation and potential liability or fines for us, governmental inquiry and oversight, damage our brand and reputation or otherwise harm our business.”

Adobe said its investigation of the attack was incomplete.