adobe.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting approximately 53.8 million clients and 95 thousand employees of adobe.com between July 2025 and June 2026. The primary driver of this exposure is historical data breaches, accounting for over 52.2 million events, with active infostealer logs contributing an additional 1.7 million. The most prevalent malware families observed are Redline, LummaC2, and Rhadamanthys, often associated with credential theft. The data suggests a broad geographical impact, with India, the United States, and Brazil showing the highest incidence. The targeted services primarily involve Adobe's authentication infrastructure, including auth.services.adobe.com and adobeid-na1.services.adobe.com. Given the scale of client and employee data involved and the prevalence of infostealer malware, this incident poses a high risk of identity theft, financial fraud, and further downstream attacks. The extensive historical data breaches suggest a long-term compromise that may have already led to the exfiltration of sensitive information. Remediation efforts should focus on immediate credential rotation for all affected employees and clients, enhanced monitoring of authentication services, and comprehensive security audits of systems handling client and employee data. The presence of multiple infostealer families necessitates a thorough investigation into the root cause of compromise and the implementation of robust endpoint detection and response capabilities.