Adobe has confirmed that a recent cyber attack compromised more than ten times the number of accounts than initially reported and also involved source code for Photoshop.
Just after the breach, Adobe chief security officer Brad Arkin said in a blog post that 2.9 million accounts had been affected, but the firm now says the figure is around 38 million active accounts.
The company said its initial statement was based on information it could validate at the time, according to the BBC.
However, the bulk of the compromise relates only to customer IDs and encrypted passwords, while the 2.9 million figure relates to encrypted payment card details and other customer order information.
Adobe has also now revealed the attackers accessed details from an unspecified number of accounts that had been dormant for two or more years and stole some source code for Photoshop.
Initial reports said the attackers had accessed the source code of Adobe’s Acrobat PDF document-editing software and ColdFusion web application creation products.
In May, Adobe moved several products to a subscription model, requiring customers to register an account and provide payment card details to qualify for upgrades.
The company said it had notified all customers that might have been affected and reset their passwords as a precautionary measure.
Adobe also said there had been no indication so far of unauthorised activity on any of the accounts involved in the breach.
The breach is a major embarrassment for the company, which had been promoting its Creative Cloud subscription services heavily since switching to the new business model.
In 2012, Adobe’s servers were breached due to a configuration error. In response to that attack, Arkin made major changes to internal security.
Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.
By submitting you agree to receive email from TechTarget and its partners.
If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Related content from ComputerWeekly.com