InfoSecBulletin Cybersecurity for mankind
A bad actor named “Mr. Raccoon” claims to breach Adobe leaking 13 million support tickets with personal data, 15,000 employee records, all HackerOne bug bounty reports, and various internal documents, as stated in a report by International Cyber Digest.
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
The threat actor said the intrusion didn’t start inside Adobe. Instead, Mr. Raccoon reportedly got in through an Indian BPO company that Adobe hired. This shows the rising risks in working with outside vendors.
Attack Chain Via BPO:
The attacker used a Remote Access Tool (RAT) on a BPO worker’s computer through a harmful email. After getting in, Mr. Raccoon tricked the worker’s manager into giving access, gaining more control in the network.
The RAT setup gave the attacker access to the employee’s webcam and let them read private messages on WhatsApp.
Perhaps the most alarming disclosure came directly from Mr. Raccoon, who told International Cyber Digest: “They allowed you to export all tickets in one request from an agent.” This suggests a significant access control misconfiguration within Adobe’s support ticketing platform — one that allowed bulk data extraction without triggering adequate security controls or rate-limiting mechanisms.
Support tickets usually have customer names, email addresses, account info, and details about technical problems. This is very valuable for phishing and identity theft.
The HackerOne submissions are very alarming because they have private vulnerability reports. These reports could be used by other attackers before fixes are made.
Adobe has not yet issue a clear statement about the breach. If it’s true, this event would be one of the biggest data leaks. It raises serious questions about how well third-party vendors are checked, managing access in support areas, and the dangers of allowing too much data to be exported in company ticketing systems.
Security teams in different fields should check their own BPO and contractor access paths, review permissions for data exports, and be alert for any credential or vulnerability information from this suspected breach showing up on dark web sites.
