Adobe has confirmed that 2.9 million customers have had private information stolen during a "sophisticated" cyber attack on its website.
The attackers accessed encrypted customer passwords and payment card numbers, the company said.
But it does not believe decrypted debit or credit card data was removed.
Adobe also revealed that it was investigating the "illegal access" of source code for numerous products, including Adobe Acrobat and ColdFusion.
"We deeply regret that this incident occurred," said Brad Arkin, Adobe's chief security officer.
"Based on our findings to date, we are not aware of any specific increased risk to customers as a result of this incident," he said.
But Chester Wisniewski, senior adviser at internet security company Sophos, told the BBC: "Access to the source code could be very serious.
"Billions of computers around the world use Adobe software, so if hackers manage to embed malicious code in official-looking software updates they could potentially take control of millions of machines.
"This is on the same level as a Microsoft security breach," he added.
Adobe said it had been helped in its investigation by internet security journalist Brian Krebs and security expert Alex Holden.
The two discovered a 40GB cache of Adobe source code while investigating attacks on three US data providers, Dun & Bradstreet, Kroll Background America, and LexisNexis.
Mr Krebs said the Adobe code was on a server he believed the hackers used.
