Adobe Breach: 13 Million Support Tickets and 15,000 Employee Records Exposed by Mr. Racoon

An Adobe Breach That Did Not Start at Adobe

A threat actor using the handle “Mr. Racoon” (also reported as “Mr. Raccoon”) is claiming a massive data theft from Adobe: approximately 13 million support tickets containing personal data, 15,000 employee records, all HackerOne vulnerability submissions, and internal documents. Adobe has not issued an official confirmation at the time of reporting, though Cybernews notes that malware researchers at vx-underground consider the claimed compromise likely legitimate, with the important caveat that the attacker did not penetrate Adobe’s internal corporate network — the intrusion is limited to its helpdesk system.

The intrusion path is the real story. According to SecurityOnline, Mr. Racoon allegedly gained initial access through an Indian Business Process Outsourcing (BPO) firm contracted by Adobe. A malicious email silently deployed a Remote Access Tool on a BPO employee’s machine. The attacker then spear-phished that employee’s manager to escalate access, pivoting deeper into the network until reaching Adobe’s support ticketing platform.

What the Attacker Actually Walked Out With

The claimed dataset, if accurate, is painful:

• ~13 million support tickets containing customer-provided personal information — names, email addresses, ticket content that frequently includes license keys, serial numbers, and screenshots of account details.
• ~15,000 employee records — the kind of data that powers the next wave of targeted phishing.
• All HackerOne bug bounty submissions — a catalog of Adobe vulnerabilities and researcher identities.
• Internal documents from the helpdesk environment.

Cyberpress and Cybersecurity News report the same figures independently, pointing to a consistent claim rather than a single-source rumor.

The Critical Misconfiguration: Bulk Export by Any Agent

The attacker’s own description of the attack reveals the defensive failure that made this incident catastrophic in size rather than merely painful. Per SecurityOnline’s reporting, Mr. Racoon noted: “They allowed you to export all tickets in one request from an agent.” That is a single sentence describing a support-platform misconfiguration with three components, all common in enterprise helpdesk deployments:

1. No per-agent rate limiting on bulk export actions.
2. No anomaly detection on agents suddenly requesting millions of records.
3. No scoping — a single agent account can export the full ticket corpus, not just their assigned cases.

That single architectural weakness is what converts a BPO compromise from a “we lost one analyst’s workload” incident into a “we lost the entire helpdesk history” incident. SQ Magazine’s summary emphasizes the same point: exposure scale depended on agent-level export privileges, not on breaking Adobe’s production network.

Why This Matters Beyond Adobe

Adobe is a high-visibility target, so the story travels. But the structural lesson is generic: most enterprises outsource some portion of customer support, sales operations, or tier-1 IT support to BPO partners. Those partners typically:

• Log into SaaS platforms (Salesforce, Zendesk, ServiceNow, custom ticketing systems) with the customer’s own identity platform.
• Often operate from low-trust home networks or shared BPO office infrastructure.
• Are frequently subject to aggressive productivity monitoring but lax endpoint-security controls.

The Register reports that a new extortion crew is actively targeting “several dozen” high-value corporations via a similar pattern — BPO pivot, credential theft, SaaS-side bulk data exfiltration. Adobe is not the end of this campaign; it is an early marker.

What CISOs and SaaS Operators Should Do This Quarter

Four concrete actions worth prioritizing:

1. Audit bulk-export capabilities across every SaaS platform with third-party contractor access. For each platform, ask: can a single agent account export more than 10,000 records in one request? If yes, impose platform-level limits, require supervisor approval for large exports, and alert on any export exceeding the threshold.
2. Enforce conditional access on BPO contractor identities. Require device posture signals, restrict logins to managed devices or approved network ranges, and reduce session durations. Treat contractor identities as a different trust tier than employees.
3. Deploy UEBA on SaaS action patterns. Unusual bulk reads, unusual data access outside an agent’s normal case set, or export-then-download sequences are detectable signals with off-the-shelf tools (Microsoft Defender for Cloud Apps, Netskope, Varonis).
4. Coordinate with the BPO on incident response. Most BPO contracts specify SLAs but not incident playbooks. Add an annex that defines breach notification timelines, log-sharing agreements, and joint tabletop participation.

Where This Leaves the BPO Supply Chain

The Adobe incident will not rewrite how enterprises use BPOs — outsourcing is a structural cost decision that will outlast any single breach. But it will raise expectations on SaaS platform vendors to ship stronger bulk-action controls by default, and it will strengthen the case for enterprise buyers to treat contractor identities as the highest-risk access class in their environment. Mr. Racoon did not need to break into Adobe. A contractor’s laptop was good enough.

Sources & Further Reading

• The BPO Backdoor: How “Mr. Raccoon” Swiped 13 Million Adobe Support Tickets — SecurityOnline
• Adobe Breach: Threat Actor Claims Leak of 13 Million Support Tickets — Cyberpress
• Adobe Breach – Threat Actor Allegedly Claims Leak of 13 Million Support Tickets and Employee Records — Cybersecurity News
• Threat actor claims Adobe breach and theft of 13 million support tickets — Cybernews
• 13M Adobe Support Tickets Allegedly Leaked in Hack — SQ Magazine
• ‘Several dozen’ orgs targeted by a new extortion crew — The Register