Adobe Site Hacked

This sucks.

I just got the email. This is ridiculous. Everyone knows I have been defending the subscription model, preferring it even, but that means Adobe has a responsibility to maintain the highest security. Like several others, I work in the daytime as a software architect and database administrator, and yes, it's tough, but it IS possible to not let it go as far as it did for Adobe.

Let's get the terminology straight: The translation to the vague term "website got hacked" is this, their databases that store everything from web content to credit card info was potentially infiltrated, and all 2.9 million customers’ data could have been exposed, including usernames, passwords, and credit card numbers. They said they don't see evidence that customer data was reached, but that's a really hard thing to verify, pinpointing that in database transaction logs isn't like dialing a phone number, lol. Yes, the CC numbers were encrypted but that’s just a deterrent, they can be unscrambled. Ugh, what a mess.

Here’s the safest thing to do, and you’re not going to be happy:

• Change your Adobe password (Adobe will force you the next time you login, no option) – Mandatory and easy
• Next, I went ahead and changed my Adobe ID which is my email address of course. You don’t HAVE to change that, but the creeps have it now and it’s entirely possible they will try your email address and old password on other sites, IE Facebook, etc.

This is important, if your Adobe ID is the same email and password that you use on other major sites like Twitter or Facebook or Adorama.com, there's a risk it will be tried. Even if you never gave Adobe your CC info, please verify that your username/password isn't the same elsewhere on the web. If it is, I would change it on those sites also.

• Now the worst part: if your credit card info was stored on Adobe's site, it's advised that you call your bank and have them give you a new credit card number. Again, you don’t HAVE to, but the evil guys may have it now, and it’s not going to take that long for them to write a script to unencrypt the numbers, and then start selling our credit card numbers online. I'm sure Adobe is PCI Compliant but every system has a back door which is why the security battle is massive. This is a REAL pain, I know, and I don’t want to have to do this, but it’s my business Visa Debit Card they have... I have to protect that.

Some may read this and say I'm overreacting. I was a victim of credit card fraud many moons ago, $90,000 was charged on my Amex and Diner's Club Card, so I've been there. It isn't fun, trust me. We do have better systems in place now, no doubt, but we also have a larger venue for fraud, meaning an entire planet data-wired together. And I know how web servers and database servers operate, and I'm not convinced Adobe can claim that data wasn't breached.

It’s not like there’s not enough going on in our lives, to have to stop and rebuild our worlds. This is one drawback to online subscription software, it just takes one database programmer to miss some security steps, and whammo, these guys get in and possibly steal it all. Frustrating…

Thanks very, very much for taking the time, Paul.

One more reason I won't be moving to "the cloud". Service as a Software Substitute (SaaSS) is a non-starter for me.

I just changed my info at Adobe just to be safe. I also called my credit card company and alerted them to the Adobe hack. I don't have any subscriptions with them--I've always purchased boxed software.

I also keep an eye on my credit report, which is always a good idea anyway.

Not much fun, but the bad guys are getting more sophisticated by the day, so we have to be vigilant.

--P

Thank you so much Paul!! I sure appreciate you telling us all the details, potential dangers, and step-by-step fixes.

Yet another reason that I'm SO GLAD I'VE DUMPED ADOBE for good. Now, if I can just get off Apple iCloud… Perhaps that's not the same kind of big deal, but I'm old-fashioned now and suspicious of new techy ways of doing things!

To Richard and Paul for alerting us to this.

to Adobe.

Yes, this really stinks. I don't understand the comments saying about not moving to the cloud, or glad I've dumped Adobe. This has nothing to do with the could subscription model. Adobe (and EVERY other) company doing business on the web is subject to the same sort of attacks. If you've dumped Adobe, you are probably using some other companies software, and guess what, they have servers connected to the internet. Yes, they are vulnerable.

I was also wondering why some are bashing Adobe. I don't see how the hack was Adobe's fault. Like you say, Keith, everyone using the Web is subject to all manner of attacks.

Just a thought for those who dumped Adobe for whatever reason: If you ordered anything from them in the past, your data may have been compromised by the hack.

--P

In the past few years, I have received notifications from three different businesses/organizations that have informed me their computers have been hacked. It is also in the news on a regular basis that various companies have been hacked. Unfortunately, it seems this is the way of life in our computer age. The first professional organization that informed me of their hacking, provided me a one year membership to a credit monitoring company free of charge. Any time there is any activity on my credit reports from the three major credit reporting agencies, the credit monitoring company sends me an email to let me know. I really enjoy the comfort level this gives me, and have continued with this credit monitoring company after my first free year was up. I highly recommend credit monitoring for anyone who puts their credit/banking information on the internet. It costs me $4.95 a month which is cheap for the piece of mind it gives to me. Of course this doesn't stop anyone from using your credit/banking information, but the quicker you find out about it the less damage will be done.

Preston, it's a quirky situation as far as saying who is at fault, but here's why I got a bit miffed at Adobe for this, and do know that I'm a huge fan of Photoshop and Premiere and wouldn't use anything else, which is why I'm aggravated that they dropped the ball. As everyone knows, Adobe was hugely aggressive at getting subscription software off the ground, much more than Microsoft who has been toeing the water for years on that score. So Adobe decided to go for it full steam ahead, knowing some of the Little Guy crowd was going to get bruised, but figured it would all iron out once everyone was used to it. I will interject quickly and say that I am so completely happy with the subscription model now that I'm seeing the benefits (I was against it at first), but that's another post altogether (HEY PAUL, GET TO THE POINT!). The point is, Adobe had a responsibility to shore up all areas of defense if they were going to push forth with the sub model which requires obvious interaction with mega thousands of customers via the internet. I know exactly how these things go, the powers that be went to the Chief Information Officer and told him to make sure everything is in place for the launch of this, and that person ask his team how things are and all the thumbs up flew around the offices. But nobody ever wants to do what we call regression unit testing (and a few other stress test procedures) to ensure that there are multiple levels of safety nets to guard the DATABASE level, because it's very hard to conjure uop every possible way that software will be used or hackers will try to infiltrate. Nonetheless, it must be done. I can understand if the site got hacked where pages were replaced and instead of the Adobe home page displaying, there was a page displaying the victory of the hack from somebody 12,000 miles away. But for the hackers to punch through to the database level is a whole different story and the ball was severely dropped. Even if Adobe outsources their ecommerce backend, balls were dropped. I wish I could say that I make my living with photography, but unfortunately I'm still a senior software architect for the 2nd largest semiconductor company in the world and I'm around this stuff all the time. Adobe should have taken better security measures on their database structure and not let hackers into that level through the website. I know that they hit the database even though Adobe says they aren't sure, because once that happened I started getting major spam, some of it non-English, and it hasn't stopped. That means the records were accessed. I use a special email address for Canon and Adobe, and now that email is hosed by spam all of a sudden, once this was announced. What we don't know is if the credit card info was successfully unencrypted but don't think that isn't being attempted. I changed my card number that day, not even giving them a chance.

So THAT'S why I'm aggravated at Adobe, they are high-level and a technology group who should have been more careful. I don't work there, I don't know the circumstances in detail, but I know this: I bet it won't happen again, lol! NO QUESTION, Adobe has locked down their infrastructure, and I feel relatively safe keeping my card on file with them now.

Paul,

I agree that this was apparently a very sophisticated attack at a low level in the dB that Adobe didn't think would occur, but it did. These hackers are getting better by the day, and it's quite scary. Vigilance on the part of all us is absolutely essential.

--P

Why I wonder is why am I learning about this here. Adobe should be contacting us.

- Dan