Adobe Allegedly Breached by "Mr. Raccoon" via Third-Party BPO Firm A threat actor known as Mr. Raccoon has claimed responsibility for a major breach of Adobe, reportedly exfiltrating a vast trove of sensitive data. According to a report by International Cyber Digest, the stolen material includes: - 13 million support tickets containing customer personal information (names, emails, account details) - 15,000 employee records - All HackerOne bug bounty submissions, which could expose unpublished vulnerabilities - Internal documents The attack did not originate within Adobe’s systems but instead exploited a supply chain vulnerability a third-party Indian Business Process Outsourcing (BPO) firm contracted by Adobe. Mr. Raccoon allegedly gained initial access by deploying a Remote Access Tool (RAT) via a malicious email to a BPO employee. The attacker then escalated privileges by phishing the employee’s manager, expanding control within the network. The RAT also reportedly enabled webcam access and WhatsApp message interception on the compromised machine. A critical security flaw in Adobe’s support ticketing platform allowed bulk data extraction without proper rate-limiting or access controls, as noted by the threat actor: “They allowed you to export all tickets in one request from an agent.” International Cyber Digest reviewed files confirming the breach’s scope, raising concerns about phishing risks, identity theft, and the weaponization of unpublished vulnerabilities from the stolen HackerOne reports. Adobe has not yet issued an official statement confirming or denying the incident. If verified, this breach would rank among the most significant of 2026, underscoring risks in third-party vendor security, privileged access management, and overly permissive data export functions in enterprise systems. The incident highlights the growing threat of supply chain attacks and the need for stricter controls over contractor access pathways.