Adobe user Impersonating my Company

[lisatwin1]

Several of my clients have received an email from Adobe impersonating my company (by using a .org instead of a .net domain)  They are sending a document through Adobe. The email address is message@adobe.com and the attachement link is (I have not followed this link; I suggest you don't either) https://acrobat.adobe.com/link/track?uri=urn:aaid:scds:US:145b64b5-40d0-4632-b339-e89a5964e500 

How can I get this shutdown immediately?  I'd like to pursue legal action against the offender, how can I find out this information? I have also requested that the google-owned domain be shutdown.

[LinSims]

That appears to be a valid Document Cloud address. 

As for the rest, I'm paging @Sil.C and @Jeffrey_A_Wright. They're Adobe employees and have a much better idea than any of us about who you need to contact and how.

[lisatwin1]

Thanks, it appeared valid to me, but doing illegal stuff! Anyway you can tell who downloaded the documents and possibly got scammed.  I dont' want the information, I just want the consumers protected.

[lisatwin1]

Just wondering, how long with this take?  It's been most of the day and this nefarious person has been stealing passwords from my clients, yet you leave their account open and documents up.

[LinSims]

I'm sorry, but other than suggesting you call customer support, there's nothing I can do. I am not an Adobe employee, and I tagged the two I know best who are here in the forums a lot.

Adobe provides support through the Chat function on the contact page or through a phone call. There is no email support.

CHAT: Click the following to contact Adobe customer support staff for help:

https://helpx.adobe.com/contact/support.html

You must be signed in with your Adobe ID and allow cookies in your web browser for this to work. Disable any ad, pop-up, or script blockers.

This is the link to the US website. If you are not in the US, the site should redirect to the page appropriate to the region associated with your ID.

Click the chat icon at the bottom right of the page to open a chat session.

If that doesn't work, try this link, which opens a chat window directly:

https://helpx.adobe.com/contact.html?rghtup=autoOpen

PHONE: You can also search this page for a regionally appropriate phone number for customer support.

https://helpx.adobe.com/contact/phone.html

[Nancy OShea]

If you suspect an impostor, report it to phishing@adobe.com.

=============
Beware of fake Adobe reps who may contact you privately offering to sell you software or take control of your computer. It's a scam, run away! Real Adobe employees will never reach out via Outlook, Yahoo, Gmail or Skype.
=============
3 Easy Ways to Identify Genuine Adobe Staff
https://tinyurl.com/10791730

[Nancy OShea]

Tell your IT dept to block the sender's IP address at the server level so their emails never get through.

[Test Screen Name]

This is a serious attack on your company, but Adobe aren't really involved. ptcharlottecpa.org was properly registered; it is a real domain (set up 2 days ago) and real email address. Once they've done that they can send you spear phishing emails to try and steal info from you, or blackmail your company; clearly they are going straight for your company. They happened to send a document using Adobe's services, but they could send it any other way, and Adobe would have no reason to close it down - they accept a registration from any valid email. You need to contact a net security specialist immediately. You could complain to the people who register domains and they might agree this is an IP violation but even if they do it could take months. Make sure ALL your staff are aware of this; attacks are likely in a variety of ways, so don't just tell them to watch out for ptcharlottecpa.org. Do a forensic check on ALL emails received recently. A lot is at stake.

[try67]

> Make sure ALL your staff are aware of this

AND all customers... You should send out a wide email to your entire contacts list informing them not to trust any emails received from the impostor domain!

But I agree that Adobe can't do anything about this. They are not the judge of who is real and who isn't.

They just provide a file-sharing website, and are certainly not going to share with you a list of IP addresses of people who downloaded the files shared by the second party. That would be a huge breach of confidence on their part, and would probably be illegal, too.