InfoSecBulletin Cybersecurity for mankind
A bad actor named “Mr. Raccoon” claims to breach Adobe leaking 13 million support tickets with personal data, 15,000 employee records, all HackerOne bug bounty reports, and various internal documents, as stated in a report by International Cyber Digest.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
The threat actor said the intrusion didn’t start inside Adobe. Instead, Mr. Raccoon reportedly got in through an Indian BPO company that Adobe hired. This shows the rising risks in working with outside vendors.
Attack Chain Via BPO:
The attacker used a Remote Access Tool (RAT) on a BPO worker’s computer through a harmful email. After getting in, Mr. Raccoon tricked the worker’s manager into giving access, gaining more control in the network.
The RAT setup gave the attacker access to the employee’s webcam and let them read private messages on WhatsApp.
Perhaps the most alarming disclosure came directly from Mr. Raccoon, who told International Cyber Digest: “They allowed you to export all tickets in one request from an agent.” This suggests a significant access control misconfiguration within Adobe’s support ticketing platform — one that allowed bulk data extraction without triggering adequate security controls or rate-limiting mechanisms.
Support tickets usually have customer names, email addresses, account info, and details about technical problems. This is very valuable for phishing and identity theft.
The HackerOne submissions are very alarming because they have private vulnerability reports. These reports could be used by other attackers before fixes are made.
Adobe has not yet issue a clear statement about the breach. If it’s true, this event would be one of the biggest data leaks. It raises serious questions about how well third-party vendors are checked, managing access in support areas, and the dangers of allowing too much data to be exported in company ticketing systems.
Security teams in different fields should check their own BPO and contractor access paths, review permissions for data exports, and be alert for any credential or vulnerability information from this suspected breach showing up on dark web sites.
