Adobe adobe.com Adobe data breach 2013: what happened and what to do
Attackers stole Adobe customer account data in October 2013. Have I Been Pwned lists 152,445,165 accounts, with emails and usernames exposed, plus passwords and password hints. The passwords were encrypted, but weakly.
View all 13,115 breaches- Breach date
- 4 Oct 2013
- Made public
- 3 Oct 2013
- Affected
- 152,445,165
- Data exposed
- Email addresses, Password hints, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In October 2013, attackers stole a large database of Adobe customer accounts. Have I Been Pwned (HIBP) gives a breach date of 4 October 2013, added the data on 4 December 2013, and counts 152,445,165 accounts. It remains one of the biggest account breaches on record.
What happened
Adobe's first public statement said 2.9 million accounts were affected. That was low. Weeks later the company said 38 million active accounts were involved. The stolen file held far more: about 153 million records in total, which HIBP counts as 152,445,165 accounts.
What was exposed
HIBP lists four data types: email addresses and usernames, plus passwords and password hints. Each record held an internal ID, a username, an email address. It also held an encrypted password and, in plain text, a password hint.
The weakness was how the passwords were protected. Adobe had encrypted them in a way that let researchers reverse many of them. Identical passwords produced identical encrypted values, so a common password could be spotted across millions of accounts. The plain text hints made guessing easier still. A hint such as "the usual" next to a popular password told researchers what they needed.
What that lets criminals do
This breach is old, but the data hasn't expired. Many people reuse passwords for years. If you used your Adobe password anywhere else, a criminal can try that email and password pair elsewhere, a technique called credential stuffing.
The password hints are a risk of their own. People often write hints that reveal the password's pattern, and the same pattern may appear in passwords you use now.
Email addresses in the data also feed spam and phishing. Fake notices about Adobe subscriptions or Creative Cloud billing are the obvious ones.
The company's response and the settlement
Adobe agreed to pay $1 million to 15 states over the breach, according to BankInfoSecurity. The agreement also requires Adobe to put better defenses in place. The sources reviewed don't describe a settlement open to claims from individual users, so don't trust any message that says you can claim money.
If you had an Adobe account in 2013
If your email appears in HIBP's Adobe entry, think back to the password you used then. Change it wherever it or a close variation is still in use.
How to check your own exposure
Search your email address on Have I Been Pwned. If it appears in the Adobe entry, you had an Adobe account in 2013. Your password manager can flag weak or repeated passwords. Check that report too. If you still have an Adobe account, look at your account security page and make sure the password is unique and two-factor authentication is on. Neither takes long. Both cut off the main way this old data still hurts people.
What to do if you were in it
- 1
Change your password and anywhere you reused it
Pick a new, unique password for the account, then change it on any other site where you used the same one. A password manager makes this quick. Think about the pattern of your old Adobe password too, and avoid reusing it. Turn on two-factor authentication where it's offered.
- 2
Stop using password hints
Hints stored next to a password can give away the password itself. Use a password manager and unique passwords so you don't need hints.
- 3
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially any that quote your name or the company. Don't click links in them. Go to the company's site yourself.
- 4
Be wary of 'claim your settlement' messages
The sources reviewed describe a $1 million payment to 15 states, not a payout to individual users. Messages offering you money tied to this breach are likely scams.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email address or phone number. Breach data can't be taken back once it's out, so the scan tells you what to change and where to stay alert.
Frequently asked
Was I affected by the Adobe data breach?
Check your email on Have I Been Pwned. HIBP lists 152,445,165 accounts. A Serus free scan checks your email and phone number against this and other breaches.
What was exposed in the Adobe breach?
Email addresses and usernames, plus passwords and password hints. The passwords were encrypted, but in a way researchers could often reverse.
Is there a settlement?
Adobe agreed to pay $1 million to 15 states, according to BankInfoSecurity. The sources reviewed don't describe a claims process for individuals.
Should I change my password?
Yes, if you used your Adobe password from 2013 anywhere you still log in. Use a unique password on every site and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
