Adobe Breach: Threat Actor Claims Leak of 13 Million Support Tickets

A threat actor operating under the alias “Mr. Raccoon” has allegedly claimed responsibility for a significant breach of Adobe, asserting the theft of a staggering volume of sensitive corporate and customer data.

The claim, first reported by International Cyber Digest, has raised serious alarms across the cybersecurity community.

According to the report, the stolen cache includes approximately 13 million customer support tickets, 15,000 employee records, internal company documents, and, most critically, all of Adobe’s HackerOne bug bounty program submissions.

The inclusion of bug bounty reports makes this alleged breach particularly severe, as those documents contain detailed, step-by-step vulnerability disclosures submitted by independent security researchers.

If any of the reported vulnerabilities remain unpatched, malicious actors could weaponize the information to launch new attacks against Adobe’s user base.

A Supply Chain Attack, Not a Direct Intrusion

The threat actor reportedly did not breach Adobe’s core infrastructure directly. Instead, the attacker exploited a weaker link in the supply chain, an Indian Business Process Outsourcing (BPO) company contracted to handle Adobe’s customer support operations.

The attack vector began with a malicious email sent to a BPO employee, which silently deployed a Remote Access Tool (RAT) on the victim’s machine.

With that initial foothold established, the attacker then sent a targeted spear-phishing message to the employee’s manager, escalating their access deeper into the network.

The hacker further claimed that the remote access tool provided visibility into the employee’s webcam feed and allowed interception of private WhatsApp messages, underscoring the invasive depth of the compromise.

Perhaps the most alarming revelation was a fundamental security misconfiguration in Adobe’s support ticketing platform. The threat actor stated that agents were permitted to export all support tickets in a single bulk request, with no rate limits, alerts, or authorization controls in place.

This means a single compromised agent account could silently exfiltrate millions of records without triggering any security alarms or requiring supervisory approval, a textbook example of overprivileged access combined with insufficient data loss prevention controls.

At the time of publication, Adobe has not issued an official statement confirming or denying the breach.

However, if the claims are verified, this incident would rank among the most significant data exposures of 2026 and would spotlight the systemic risks posed by third-party vendor access.

Security teams across industries should treat this as a critical reminder to audit BPO and vendor access privileges, enforce least-privilege principles, implement bulk export restrictions, and monitor agent-level activity for anomalous behavior.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google

The post Adobe Breach: Threat Actor Claims Leak of 13 Million Support Tickets appeared first on Cyber Security News.