Adobe data breach (2013): what was exposed
2 min read · Updated October 15, 2026
In October 2013 Adobe disclosed that attackers had accessed customer data. A large dump of roughly 150 million records later circulated, with email addresses, encrypted passwords and plain-text password hints. If you had an Adobe account then, change reused passwords and check your email for exposure.
What happened
Adobe first reported that millions of accounts were affected. A much larger file then appeared online with records for around 150 million accounts, which showed that the true scale was greater than first announced.
What was exposed
- ✓Email addresses and usernames.
- ✓Encrypted passwords, protected in a way that made patterns easy to spot.
- ✓Password hints stored in plain text, which helped crack many passwords.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
The lesson about hints
Plain-text hints next to encrypted passwords revealed what many users chose. Avoid password hints that reveal the password, and choose unique passwords that a hint cannot give away.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Is Adobe safe to use now?+
Secure your account with a unique password and two-step verification.
Were payment details exposed?+
The company reported that some customer order information and encrypted card data were accessed. Review your statements if you were a customer at that time.
How do I know if I was affected?+
Check your email in a breach lookup.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.