Adobe Breach - Threat Actor Claims Leak of 13 Million Records
Basically, a hacker says they stole a lot of sensitive data from Adobe.
A hacker claims to have breached Adobe, leaking sensitive data including 13 million support tickets and employee records. This incident highlights serious third-party security risks.
What Happened
A threat actor known as Mr. Raccoon has allegedly breached Adobe, claiming to have exfiltrated a significant amount of sensitive data. This includes 13 million support tickets containing personal information, 15,000 employee records, and all HackerOne bug bounty submissions. The breach was reported by the International Cyber Digest on April 3, 2026.
How the Breach Occurred
The attack did not originate directly from Adobe’s infrastructure. Instead, Mr. Raccoon reportedly gained initial access through an Indian Business Process Outsourcing (BPO) firm contracted by Adobe. This method highlights the increasing risks associated with third-party vendor relationships. The attacker deployed a Remote Access Tool (RAT) on a BPO employee’s machine via a malicious email. After establishing this foothold, Mr. Raccoon escalated access by phishing the compromised employee’s manager, thus broadening control within the network.
The Data Exposed
The alleged dataset is particularly sensitive for several reasons:
- Support tickets typically contain customer names, email addresses, account details, and descriptions of technical issues, making them a goldmine for phishing campaigns and identity theft.
- The inclusion of HackerOne submissions is especially concerning, as these contain unpublished vulnerability reports that could be exploited by other threat actors before patches are deployed.
Security Implications
Mr. Raccoon claimed that Adobe's support ticketing platform allowed bulk data export without triggering adequate security controls. This suggests a significant access control misconfiguration. If verified, this incident would represent one of the most significant data exposures of 2026, raising urgent questions about third-party vendor security vetting and privileged access management in support environments.
What You Should Do
Security teams across various industries are advised to:
- Monitor their own BPO and contractor access pathways.
- Audit bulk data export permissions to ensure they are not overly permissive.
- Stay vigilant for any credential or vulnerability data from this alleged breach appearing on dark web forums.
At the time of publication, Adobe has not officially confirmed the breach. As the situation develops, organizations must remain proactive in their cybersecurity measures to mitigate similar risks.