Adobe — 153 Million Accounts, and a Password Scheme That Became a Crossword (2013)

What happened

In October 2013, 152,445,165 Adobe accounts were breached. Each record contained an internal ID, a username, an email address, an encrypted password and — the detail that made this breach famous — a password hint stored in plain text.

The mistake was using encryption at all

Passwords are supposed to be hashed: transformed by a one-way function so that even the company storing them cannot read them back. Adobe instead encrypted them, with Triple DES in ECB mode. Encryption is two-way by design, so anyone who obtained the key could read every password directly.

Nobody needed the key. ECB — Electronic Codebook — has the property that identical plaintext always produces identical ciphertext. Every account that used the same password produced the same encrypted block, in a dump of 153 million rows. That turns the dataset into a frequency-analysis puzzle: the most common block is almost certainly the most common password.

And then the hints. The plaintext hints were attached to those blocks, so every user who wrote something like "my dog's name" was contributing a clue about a password shared with everyone else holding the same ciphertext. Researchers, including analyses by Sophos and commentary from Bruce Schneier, recovered large portions of the password set by cross-referencing repeated blocks against pooled hints — no key required.

Why this one keeps mattering

Adobe accounts were not optional for a whole profession. Anyone who used Photoshop, Illustrator, InDesign or Acrobat between the mid-2000s and 2013 had one, frequently registered with a work address and frequently shared across a studio or team. It is one of the few breaches on this list where the affected population is defined by occupation rather than by pastime.

Because so much of the password set was recovered in readable form, this dump became foundational training data for password-guessing tools. Its influence outlived the accounts by a wide margin: the patterns it revealed shaped how cracking software prioritises candidates to this day.

The identity-chain implication

Password hints are, in effect, leaked answers to security questions. "Mother's maiden name", "street I grew up on", "first pet" — the hint field collected exactly the facts that account-recovery flows still use to verify identity, and published them in the clear.

That is why this breach reaches beyond Adobe. A recovered hint does not just reveal an Adobe password; it can answer the recovery question guarding an email account, a bank or a domain registrar more than a decade later, because none of those facts ever changed.

What to do now