Data protection experts reported the finding of more than 7 million Adobe Creative Cloud user records exposed due to a database with configuration errors. The exposed implementation has already been secured.
Although no passwords or financial details were found, the database did contain really detailed information about nearly 7.5 million customers, including the list of Adobe products they use and user IDs, subscription plans, and payment background.
Bob Diachenko, dedicated to searching for information exposed on the Internet, reported the finding of the database on October 19. The investigator mentions that he doesn’t know if anyone had access to this database before him. The full list of data stored in each user record includes:
- Email address
- Account creation date
- List of Adobe products used
- Subscription status
- Member ID
- Country
- Login registration
- Payment status
Data protection specialists mention that in the event that a threat actor has gained access to the compromised information, millions of Adobe users would be exposed to sophisticated spear phishing campaigns, usually aimed at extract information from the victims’ payment cards.
This variant of fraud can be really harmful to victims, because using compromised information criminals can pose as service providers or government organizations to get victims to turn over their data more Sensitive. At the moment there is no way to determine whether any malicious hackers were able to access the information exposed before Adobe secured the database, data protection experts mention.
Through a statement, Adobe mentioned that a vulnerability related to one of its prototypes has been detected, which was secured almost immediately. “The compromised environment hosted information from Creative Cloud users; this issue is not related to Adobe’s core operations,” adds the company’s message.
Comparitech, a firm that discovered the database in collaboration with Diachenko, confirmed that Adobe received its report and acted immediately and securing the database the same day.
Cybersecurity expert Thom Bailey says spear phishing isn’t the only risk Creative Cloud users are exposed to. “The above details could even serve as an access point to an organization’s networks, from where hackers could execute malicious code, among other activities,” the expert says.
The risk of hackers starting to deploy these campaigns is latent, so data protection specialists at the International Institute of Cyber Security (IICS) recommend Adobe users remain alert to the potential occurrence of suspicious emails requesting information or directing to external sites. Remember that companies never send emails requesting personal data from their customers or send emails with links to third-party sites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
