2013 · Software

Adobe, 2013: 153 million records and the world's worst crossword

Case file · 4 min read · Published 14 September 2026

People affected: 153 million records
When it happened: Discovered September 2013
Made public: 3 October 2013
How they got in: Intrusion into internal systems; source code taken alongside customer data
Attributed to: Never publicly identified
What it cost: A $1 million-plus settlement with 15 US states, plus an undisclosed class-action settlement

What was exposed: Email addresses · Encrypted passwords · Plaintext password hints · Encrypted card numbers · Names · Product source code

Adobe's 2013 breach is not remembered for its size, although 153 million records was enormous for the time. It is remembered because the company had made a specific, fixable engineering decision about how to store passwords, and the dump turned that decision into a public demonstration of why it was wrong.

What happened

In late September 2013, Adobe found that intruders had been inside its systems. On 3 October it announced that customer information had been taken and that source code for several products had been copied — a combination that is unusual and, for a software vendor, worse than either on its own.

The numbers moved. Adobe first said 2.9 million customers, then raised it to 38 million active users. The file that circulated publicly held around 153 million records, including accounts that were long dormant or invalid. Both statements can be true at once: 38 million was Adobe's count of active accounts it considered affected; 153 million was what was actually in the database.

The password decision

A system that checks passwords does not need to be able to read them. That is the whole point of a password hash: the site stores a one-way transformation, and at login it repeats the transformation and compares. Done properly — a slow algorithm, a unique random salt per user — a stolen file yields almost nothing, and two users with the same password produce entirely different stored values.

Adobe did not hash. It encrypted, using Triple DES in ECB mode, with one key for everybody.

Two consequences follow, and they compound:

Encryption is reversible. A hash cannot be undone by anyone, including the company that made it. Encryption can, by anyone holding the key. The moment the key is compromised, every password in the file is readable.
ECB mode is deterministic. The same input produces the same output, every time, with no salt to break the pattern. So in the dump, every account that used 123456 shared an identical block of ciphertext. You could not read the password, but you could group together the hundreds of thousands of people who had chosen it.

And then the hints. Alongside each encrypted password sat the user's own password hint — in plain text. Individually a hint is often meaningless. Collectively, with every account sharing a password grouped together by its identical ciphertext, the hints became a set of clues pointing at one answer: "numbers", "1 to 6", "first six numbers", "count". The puzzle solves itself. An xkcd strip presented the whole thing as a crossword, which is how most people outside the industry came to understand the flaw, and the nickname has outlived the incident.

The result was that researchers reconstructed the most common passwords in the file without ever attacking the encryption. The top entries were 123456, 123456789, password and adobe123 — a ranking that has barely changed in the decade since.

The source code, which mattered more

Lost customer records damage the people in them. Lost source code damages everyone who runs the software. Adobe confirmed that code for ColdFusion and Acrobat, among others, was taken. ColdFusion in particular was widely deployed on internet-facing servers inside other organisations, and an attacker holding its source has a permanent head start in finding new vulnerabilities in it.

This is the part of the Adobe breach that is hardest to quantify and easiest to underrate. Customer data ages. Source code that ships into other people's infrastructure hands an attacker a research capability that keeps paying out for years.

The timeline

September 2013 — Adobe detects the intrusion.
3 October 2013 — Public disclosure: 2.9 million customers, plus stolen source code.
29 October 2013 — The figure is revised to 38 million active users.
November 2013 — A file of roughly 153 million records circulates; researchers begin reconstructing passwords from hints.
November 2016 — Adobe settles with 15 US states and the District of Columbia for over $1 million, alongside an undisclosed consumer settlement.

What it changed

The Adobe file became a teaching artefact. Before it, "hash your passwords properly" was an argument security engineers had with product teams about theoretical risk. Afterwards there was a concrete, visual example of what the alternative looks like when the file gets out — and, crucially, one that a non-specialist could follow in ninety seconds.

It also killed the password hint as a feature. Hints existed to reduce support calls; they survive almost nowhere now, because Adobe demonstrated that a hint is a piece of plaintext that describes a secret, stored next to the secret, and available to anyone who takes the database.

The third legacy is more subtle. Adobe is one of the clearest cases of a breach figure that moved with the definition: 2.9 million, then 38 million, then 153 million, depending on whether you counted customers Adobe believed were affected, active accounts, or rows in the file. Almost every breach since has produced the same divergence, and reading a disclosure now means asking what exactly is being counted.

If you had an Adobe account in 2013

Any password you used then should be considered public. Not weakened — public. If it, or a close variant with a number bumped, is still in use anywhere, change it today.
Check where else that address appears. The Adobe list has been recycled into credential-stuffing collections for over a decade; checking an address against known breaches shows how widely it has travelled.
Stop answering hint and security questions truthfully. Where a service forces them on you, generate a random answer and store it in your password manager.
Use a manager and stop reusing. Nothing in this case file would have mattered to an individual user with a unique password per site — see the practical version of that advice.

Questions people ask

Why was Adobe's password storage so bad?

Adobe encrypted passwords with Triple DES in ECB mode using a single key, rather than hashing them. Encryption is reversible by design, and ECB mode produces the same ciphertext for the same input every time — so identical passwords looked identical in the dump. Proper password storage uses a slow, salted hash, which cannot be reversed even by the company that stored it.

What was the Adobe password crossword?

Because the password hints were stored in plain text next to the encrypted passwords, anyone with the file could group together every account sharing a password and read the hints as a set of clues to the same answer. One hint might be useless; two hundred hints for the same ciphertext were not. A widely shared xkcd comic laid it out as a crossword puzzle, and the name stuck.

How many Adobe accounts were affected?

Adobe first said 2.9 million, then 38 million active users. The file that actually surfaced contained around 153 million records, including long-dormant and invalid accounts. The 153 million figure is the one the dump supports.

Was source code stolen too?

Yes. Adobe confirmed that source code for several products, including ColdFusion and Acrobat, was taken. Stolen source code is a longer-term risk than a customer list: it lets an attacker hunt for vulnerabilities in software that is deployed inside thousands of other organisations.

Sources

Adobe customer security announcements, October and November 2013
Multistate attorneys general settlement, November 2016
Analysis of the published dump by Sophos and by password researcher Jeremi Gosney, 2013
xkcd 1286, "Encryptic" — the crossword framing that made the flaw legible to non-specialists