Adobe breach impacts 38 million as SJSU tightens network security
by Michael Chen
Nov 2, 2013 9:37 pm
The recent cyber-attack on Adobe has affected an increased number of 38 million affected customers, stated Adobe spokesperson Heather Edell in a Krebsonsecurity blog post.
The original report by Adobe that a cyber-attack reportedly breached its network on Oct. 3 affected up to 2.9 million customers’ personal information, including credit card numbers.
Catheryn Cheal, SJSU senior academic technology officer, said the Adobe breach has not changed the university’s relationship and partnership with Adobe.
“We have purchased licenses through Adobe,” Cheal said. “We pay them a small amount for each download because we have this third party agreement between us and Adobe.”
Cheal said the Adobe breach does not affect many students on campus because most students obtain Adobe software for free because of the agreement between SJSU and Adobe.
Adobe sent out emails and letters in October that notified affected customers, according to Adobe’s customer security alert website. In a letter that Kim Komenich, new media journalism associate professor, received it stated, “We recently discovered that between Sept. 11 and Sept. 17, an unauthorized third party illegally accessed certain customer order information.“
Adobe verified on Oct. 3 that stolen information included about 2.9 million customer credit cards, as well as source code for the Adobe products: ColdFusion, Acrobat and ColdFusion Builder. Source code refers to computer language written in readable text that enable users to modify or understand how a program works.
Adobe further stated in the letter that affected customers are entitled to one free credit report every 12 months and that they would provide services such as daily credit monitoring and identity theft insurance for no cost one year after enrollment. Customers would need to pay of $9.95 per month after one year.
“We have engaged Experian to provide you with its ProtectMyID alert membership, which provides daily credit monitoring of the Experian credit bureau, fraud resolution assistance and identity theft insurance,” the letter stated. “You have until Feb. 28, 2014 to activate this complementary credit monitoring membership.”
A ProtectMyID membership for regular consumers costs $9.95 per month after a 30-day free trial period, according to Experian’s website.
Hiedie Sioteco, a senior graphics design major, said she purchased and used a wide range of Adobe products such as Dreamweaver, Photoshop and InDesign before SJSU’s dealings with Adobe. But now, she said, she is worried about storing her information online even though she was not affected by the cyber-attack.
“I’ve never felt comfortable leaving my information on the Internet,” Sioteco said. “If my information is out there, I’m going to be worried someone is going to have my info, identity, credit and buy stuff with my credit.”
Mike Cook, identity and information security manager for Information Technology Services said although SJSU is partnered with Adobe Systems, privacy laws prevented IT Services from learning about the breach before it was announced by Adobe.
Cook said the event was first brought to IT’s attention through the university’s subscription to a free security alert service and by the media within the first 24 hours and was followed shortly with an email from Adobe.
Shai Silberman, director of network services for IT services, said hackers constantly look for vulnerabilities and constantly check different versions of software for vulnerabilities.
“The large-caliber attacks tend to create (a) denial-of -service attack, which renders the target system inoperable as happened to Sony (in 2011),” Silberman said. She said the attacks that go after information theft tend to be under the radar and try to avoid detection altogether.
Cook said SJSU is taking measures to strengthen its own network security.
“Our network security structure is being updated across the board: including new firewalls, Application Visibility Control, Ironport web filtering and Identity Services Engine from our partner, Cisco Systems,” Cook said. “Additionally, IT services is deploying a new Information Security Program to establish a number of new controls and updated policies, standards and procedures regarding campus technology.”
Sioteco said she would still trust Adobe if her information was breached, but said it would bring down the company as a whole because its sponsors will be affected. She said schools and businesses that trust them are going to wonder if information will be secure and they may hold back and be hesitant about it.
However, Cheal said the breach would not affect Adobe’s public image.
“I think that the public has mostly lived through one cyber-attack through another for the past 15 years,” Cheal said. “I don’t think people see it as a black mark on the company that is attacked, compared to the ones responsible for the attack.”