Adobe data leak

Several days ago major news organizations picked up the story of the adobe data leak. Adobe released a security notice on Oct 3 notifying its customers that their data has been stolen. According to the security notice, 2.9 customers were affected; however, 38 million users were notified and it is believed that as much as 150 million passwords were stolen. Stolen data consisted of emails, encrypted passwords and plaintext hints (user hints to remind themselves of their password in case they forget it). Adobe claimed that all confidential data that was lost was encrypted. Recent analysis by Paul Ducklin seems to indicate that stolen data was not salted or hashed. Worse, it appears that the passwords were encrypted using a single key. In other words, if someone gets the secret key then they would have be able to decrypt every single password. The discussion around this story comes down to how badly Adobe mismanaged user passwords (using block cypher instead of hash and salt combination) and the sheer scale of this breach. I would like to mention my take on this story. If a significant amount of passwords are recovered than this event has the potential to have the scale and magnitude of 2009 rockyou.com leak. In other words, this could be a giant data sample that could be used to refine and improve password crackers. Password crackers don't simply brute force passwords, but they exploit the common features of passwords (ie substituting numbers for letters, appending number to words). In other words, crackers look for common patterns in passwords and write algorithms that exploit those patterns, significantly reducing the time needed to break/crack passwords. This leak could be a potential gold mine for passwords. Sure most of these (even all) have been changed but understanding common themes in how people chose passwords may be a lot more valuable then the initial breach.