Specifically, the researchers discovered an unsecured Elasticsearch database containing data of Adobe Creative Cloud users. Anyone with access to the internet could easily view the data without requiring any authentication.
The unprotected server contained around 7.5 million records of the users. The data included personal information of the individuals, such as email addresses, Member ID, country, date of account creation, subscription status, payment status, Adobe products in use, and time since last login. It also leaked information about whether the user is an Adobe employee or not.
Despite the explicit personal information it leaked, the unsecured database did not expose any financial data or passwords.
However, Diachenko estimates that the database remained publicly accessible for about a week. Moreover, it also remains unconfirmed whether anyone else has accessed the database during this time.
Although, the exposed records did not contain any sensitive information about the users, such as account passwords, bank data or credit card details. Nonetheless, the extent of information still poses a threat of phishing attacks to the users. As stated by Comparitech in their report,
The information exposed in this leak could be used against Adobe Creative Cloud users in targeted phishing emails and scams. Fraudsters could pose as Adobe or a related company and trick users into giving up further info, such as passwords, for example.Hence, the users must remain very careful should they receive any emails posing from Adobe that ask for passwords or sensitive data.
