Adobe Confirms Security Breach, Hackers Steal Source Code and 2.9 Million Customer’s Detail
The attackers accessed encrypted customer passwords and payment card numbers, the company said.
But it does not believe decrypted debit or credit card data was removed.
Adobe also revealed that it was investigating the “illegal access” of source code for numerous products, including Adobe Acrobat and ColdFusion.
“We deeply regret that this incident occurred,” said Brad Arkin, Adobe’s chief security officer.
“Based on our findings to date, we are not aware of any specific increased risk to customers as a result of this incident,” he said.
But Chester Wisniewski, senior adviser at internet security company Sophos, told the BBC: “Access to the source code could be very serious.
“Billions of computers around the world use Adobe software, so if hackers manage to embed malicious code in official-looking software updates they could potentially take control of millions of machines.
“This is on the same level as a Microsoft security breach,” he added.
Adobe said it had been helped in its investigation by internet security journalist Brian Krebs and security expert Alex Holden.
The two discovered a 40GB cache of Adobe source code while investigating attacks on three US data providers, Dun & Bradstreet, Kroll Background America, and LexisNexis.
Mr Krebs said the Adobe code was on a server he believed the hackers used.
Adobe said it is resetting customer passwords of those who were affected by the attack. Adobe said it’s also in the process of notifying customers whose credit or debit card information might have been compromised, as well as getting in touch with the banks processing customer payments.
“We deeply regret that his incident occurred,” Adobe said in a blog post. “We’re working diligently internally, as well as with external partners and law enforcement, to address the incident.”