Adobe hacked, 2.9 million users left vulnerable

At least 2.9 million customers of software company Adobe may have their data compromised following a major security breach into the firm's systems.

In a blog post, Adobe chief security officer Brad Arkin said the attack came shortly after they noticed recent sophisticated attacks on the company's network.

"Our investigation currently indicates that the attackers accessed Adobe customer IDs and encrypted passwords on our systems. We also believe the attackers removed from our systems certain information relating to 2.9 million Adobe customers, including customer names, encrypted credit or debit card numbers, expiration dates, and other information relating to customer orders," he said.

"We deeply regret that this incident occurred. We’re working diligently internally, as well as with external partners and law enforcement, to address the incident," he added.

But he said they do not believe the attackers removed decrypted credit or debit card numbers from Adobe's systems.

Arkin said the previous attacks involved the illegal access of customer information as well as source code for numerous Adobe products.

He said they believe the previous attacks and the recent breach "may be related."

Steps

For now, Arkin said they are taking some security steps, including:

- resetting relevant customer passwords to help prevent unauthorized access to Adobe ID accounts. Affected customers will get an email notification on how to change their passwords.
- notifying customers whose credit or debit card information Adobe believes to be involved in the incident. They will get a notification letter with additional information on steps to protect against potential misuse of personal information.

Arkin said Adobe is also offering customers whose credit or debit card information was involved an option to enrol in a one-year complimentary credit monitoring membership where available.

"We have notified the banks processing customer payments for Adobe, so that they can work with the payment card companies and card-issuing banks to help protect customers’ accounts.
We have contacted federal law enforcement and are assisting in their investigation," he said.

Meanwhile, he said Adobe is also investigating the illegal access to source code of numerous Adobe products.

"Based on our findings to date, we are not aware of any specific increased risk to customers as a result of this incident," he said.

Identity theft

A separate article on Mashable said that since the personal data was encrypted, "it appears the risk for fraud or identity theft is low."

"But no details are clear on the kind of encryption or security Adobe used for the stolen data," it added (http://mashable.com/2013/10/03/adobe-data-hack/).

Mashable also cited independent security reporter Brian Krebs who said Adobe has been aware of the breach since Sept. 17, when Krebs disclosed the attack.

It said Adobe told Krebs that it believes the attack was carried out in mid-August. — TJD, GMA News