Trove of Adobe user data found on Web after breach: security firm

Reuters/Leonhard Foeger/FilesAdobe company logos are seen in this picture illustration taken in Vienna on July 9

A computer security firm has uncovered data it says belongs to some 152 million Adobe Systems Inc user accounts, suggesting that a breach reported a month ago is far bigger than Adobe has so far disclosed and is one of the largest on record.

LastPass, a password security firm, said on Thursday that it has found email addresses, encrypted passwords and password hints stored in clear text from Adobe user accounts on an underground website frequented by cyber criminals.

Adobe said last week that attackers had stolen data on more than 38 million customer accounts, on top of the theft of information on nearly 3 million accounts that it disclosed nearly a month earlier.

The maker of Photoshop and Acrobat software confirmed that LastPass had found records stolen from its data center, but downplayed the significance of the security firm's findings.

While the new findings from LastPass indicate that the Adobe breach is far bigger than previously known, company spokeswoman Heather Edell said it was not accurate to say 152 million customer accounts had been compromised because the database attacked was a backup system about to be decommissioned.

She said the records include some 25 million records containing invalid email addresses, 18 million with invalid passwords. She added that “a large percentage” of the accounts were fictitious, having been set up for one-time use so that their creators could get free software or other perks.

She also said that the company is continuing to work with law enforcement and outside investigators to determine the cost and scope of the breach, which resulted in the theft of customer data as well as source code to several software titles.

The company has notified some 38 million active Adobe ID users and is now contacting holders of inactive accounts, she said.

Paul Stephens, director of policy and advocacy for the non-profit Privacy Rights Clearinghouse, said information in an inactive database is often useful to criminals.

He said they might use it to engage in “phishing” scams or attempt to figure out passwords using the hints provided for some of the accounts in the database. In some cases, people whose data was exposed might not be aware of it because they have not accessed the out-of-date accounts, he said.

“Potentially it's the website you've forgotten about that poses the greater risk,” he said. “What if somebody set up an account with Adobe ten years ago and forgot about it and they use the same password there that they use on other sites?”

FORGOT THE SALT?

LastPass Chief Executive Joe Siegrist said that Adobe failed to use best practices for securing the stolen passwords.

The ones in the database were not protected with a technique known as “salting,” which means adding a secret code to every password after it is scrambled and before it is stored in the database. That way multiple encrypted versions of the same password never look the same.

Because the passwords were not salted, Siegrist said he was able to identify the most frequently used password in the group, which was used 1.9 million times. The database has 108 million email addresses with passwords shared in multiple accounts.

“I'd say 108 million people fall into the range of likely very easily guessable passwords,” he said.

The number of records stolen appears to be the largest taken in any publicly disclosed cyber attack to date.

The largest cyber breach previously reported was a 2009 attack on Heartland Payment Systems in which more than 130 million credit card numbers were stolen, according to Privacy Rights Clearinghouse data. Hackers accessed more than 100 million records from the Sony PlayStation Network in 2011 in another notorious attack.

Mike Spanbauer, managing director of research at the security firm NSS Labs, noted that the impact of the Adobe breach might not be as significant as ones where large numbers of financial records were stolen.

Still, he said that the attack was a strong reminder that consumers and businesses need to be vigilant about making sure they do not reuse passwords.AdobebusinessScience & Technology

If you find our journalism valuable and relevant, please consider joining our Examiner membership program.
Find out more at www.sfexaminer.com/join/

Just Posted

Police release an image a cracked windshield on a Prius that Cesar Vargas allegedly tried to carjack. Vargas, who was shot by police a short time later, can be seen in videos jumping on the windshield and pushing a Muni passenger who disembarked from a bus. (Courtesy SFPD
SFPD releases videos of deadly police shooting

Cesar Vargas killed after reports of carjacking with knife

New legislation would make sure supportive housing tenants don’t pay more than 30 percent of their income for rent.. (Kevin N. Hume/S.F. Examiner))
Supportive housing tenants could get more help paying the rent

Supportive housing tenants struggling to pay rent could soon see their payments… Continue reading

Organizers of the San Francisco International Arts Festival had planned to use parts of Fort Mason including the Parade Ground, Eucalyptus Grove and Black Point Battery to host performances by about a dozen Bay Area arts groups. (Kevin N. Hume/S.F. Examiner)
Arts festival sues city over permit denial

Organizer says outdoor performances should be treated like demonstrations, religious gatherings

An oversight body for San Francisco’s mental health programs may be restructured after questions were raised about its management and lack of effectiveness. (Kevin N. Hume/S.F. Examiner)
Behavioral health oversight body looks for new start — and staff — after mismanagement

Members of an oversight body for San Francisco’s behavioral health programs said… Continue reading

The City requires the recycling or reuse of debris material removed from a construction project site. <ins>(Emma Chiang/Special to S.F. Examiner)</ins>
<ins></ins>
Permits proposed for haulers of construction debris to achieve zero-waste

San Francisco plans to tighten regulations on the disposal of construction and… Continue reading

Most Read