A claim attributed to an actor operating as "Mr. Raccoon" describes 13 million Adobe support tickets and around 15,000 employee records obtained through a business process outsourcing vendor, via phishing of a contractor. The claim is unconfirmed and we grade this file low.
We are filing it for the route rather than the volume, because the route is now the most common one in our database.
Outsourced Support Inherits Full Access
A business process outsourcing arrangement gives an external workforce the access an internal support team would have. That is the point: they answer the same tickets and need the same systems.
What frequently does not transfer is the surrounding control environment — device management, network controls, phishing-resistant authentication, and the security awareness programme. The access travels; the assumptions underneath it do not.
Tickets Again
This is the second file this year on support ticket archives, after the EY incident in 26-0713. The reason is structural: tickets accumulate attachments, are retained indefinitely because deletion has no owner, and are classified as operational rather than sensitive.
What would move this file to medium: acknowledgement of an incident, or verification of any portion of the claimed data. Neither exists.
Compiled from public reporting, listed below. Every figure originates with the claiming actor and is unconfirmed. We are not asserting that the named company suffered an incident. Corrections: corrections@forensicpost.com.
- List of recent data breaches in 2026Bright Defense