Adobe data breach (2013)

On 3 October 2013, Adobe Systems disclosed a network intrusion that ultimately exposed roughly 153 million account records and the source code for several flagship products. It remains a textbook example of how not to store passwords.

What happened

Adobe began investigating in September 2013 after security researchers, including Brian Krebs and Alex Holden, discovered a 40 GB cache of Adobe source code on a server tied to the attackers. The same actors had penetrated Adobe's internal network and accessed customer databases.

Adobe's first public estimate was modest: 2.9 million customers whose names, encrypted credit/debit card numbers and order information were touched. Within weeks that figure collapsed. The leaked credentials file that surfaced online contained about 153 million records — Have I Been Pwned later catalogued 152,445,165 unique accounts.

How it went wrong

The breach is remembered less for its size than for Adobe's cryptographic negligence. Rather than salting and hashing passwords, Adobe encrypted them with a single key using 3DES in ECB mode. ECB encrypts identical blocks identically, so every user who chose the same password produced the same ciphertext — turning the dump into a giant pattern-matching puzzle.

Worse, Adobe stored password hints in plaintext alongside the encrypted passwords. Hints like "the usual" or "name+1984" clustered against shared ciphertexts let researchers recover enormous numbers of passwords without ever breaking the encryption. The most common password recovered was "123456," followed by "123456789" and "password."

Impact

• Roughly 153 million account records (emails, usernames, encrypted passwords, plaintext hints) were leaked publicly and widely traded.
• Source code for products including Acrobat, ColdFusion and ColdFusion Builder was stolen, raising fears that attackers could mine it for zero-day vulnerabilities.
• Adobe reset affected passwords and offered one year of free credit monitoring to customers whose card data may have been exposed.
• In 2016, Adobe paid US$1 million to settle with 15 state attorneys general, and earlier settled a consumer class action.

Why it matters

The Adobe dump became a permanent fixture in password-cracking research and wordlists, and the phrase "encrypted, not hashed" entered the security lexicon as shorthand for a fundamental design error. It hardened industry consensus that passwords must be salted and slow-hashed (bcrypt, scrypt, Argon2), never reversibly encrypted, and that "secret" hints stored next to credentials are themselves a liability. For more than a decade, the Adobe breach has served as the canonical cautionary tale taught alongside the basics of credential storage.