3 million Adobe accounts leaked? Make that 38 MILLION... or MORE

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.theregister.co.uk/2013/10/30/adobe_data_breach_millions_of_accounts/

Remember that Adobe security breach earlier this month that leaked the
account records of some 3 million customers? Scratch that: the actual
number was at least 38 million, it has emerged.

In early October, Adobe warned of "sophisticated attacks" on its network in
which hackers gained access to data for what was then believed to be about
2.9 million customers: that data included names, encrypted credit or debit
card numbers, expiration dates, and other information relating to customer
orders.

In addition, the company said, the cyber-crooks had managed to abscond with
source code for "numerous Adobe products."

But in a blog post on Tuesday, investigative journalist Brian Krebs said
those early estimates were far too low, and that the actual list of
accounts that had been compromised numbered in the tens of millions.

How does Krebs know? Because he's seen the list. Over the weekend, he says,
AnonNews.org posted a 3.8GB file called "users.tar.gz" that contained more
than 150 million user and password pairs that had apparently been lifted
from Adobe.

Adobe spokeswoman Heather Edell has since confirmed the breach to Krebs,
adding that the company has contacted the owners of the affected accounts
and has reset the passwords for all of the Adobe IDs that it believes were
involved in the hacking incident.

"So far, our investigation has confirmed that the attackers obtained access
to Adobe IDs and (what were at the time valid) encrypted passwords for
approximately 38 million active users," Edell said. "We are still in the
process of investigating the number of inactive, invalid and test accounts
involved in the incident."

Edell also said that the attackers were able to gain access to at least
some of the source code for Adobe Photoshop. Krebs was able to confirm
that, too – a second, 2.56GB file posted to AnonNews.org contained what
appeared to be Photoshop code.

Source code for Adobe Acrobat, Reader, and the ColdFusion web application
server software is also believed to have leaked during the incident, but at
least some of this data appears to have been password protected and may not
be readily accessible.

Adobe seems to be taking its customer data breach seriously. The company
has offered one year's worth of free credit monitoring by Experian to any
customer whose account was compromised in the attack. But as Krebs points
out, this kind of service isn't guaranteed to spot all of the forms of
identity theft that might arise from such incidents, so Adobe customers are
advised to place fraud alerts on their accounts and monitor their credit
reports closely.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

# OWASP http://www.appsecusa.org
# Builders, Breakers and Defenders
# Time Square, NYC 20-21 Nov
o()xxxx[{::::::::::::::::::::::::::::::::::::::::>

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security offers security intelligence, risk management services and customized security solutions. The 
YourCISO portal gives decision makers access to tools for evaluating their security posture and prioritizing risk 
mitigation strategies. Cyber Risk Analytics offers actionable threat information and breach analysis.