Player has also been criticized for, among other things, suffering from performance, memory usage and security problems (see criticism of Flash Player). A report by security researchers from Kaspersky Lab criticized Adobe for producing the products having top 10 security vulnerabilities. Observers noted that Adobe was spying on its customers by including spyware in the Creative Suite 3 software and quietly sending user data to a firm named Omniture. When users became aware, Adobe explained what the suspicious software did and admitted that they: "could and should do a better job taking security concerns into account". When a security flaw was later discovered in Photoshop CS5, Adobe sparked outrage by saying it would leave the flaw unpatched, so anyone who wanted to use the software securely would have to pay for an upgrade. Following a fierce backlash Adobe decided to provide the software patch. Adobe has been criticized for pushing unwanted software including third-party browser toolbars and free virus scanners, usually as part of the Flash update process, and for pushing a third-party scareware program designed to scare users into paying for unneeded system repairs. Customer data breach On October 3, 2013, the company initially revealed that 2.9 million customers' sensitive and personal data was stolen in a security breach which included encrypted credit card information. Adobe later admitted that 38 million active users have been affected and the attackers obtained access to their IDs and encrypted passwords, as well as to many inactive Adobe accounts. The company did not make it clear if all the personal information was encrypted, such as email addresses and physical addresses, though data privacy laws in 44 states require this information to be encrypted. A 3.8 GB file stolen from Adobe and containing 152 million usernames, reversibly encrypted passwords and unencrypted password hints was posted on AnonNews.org. LastPass, a password security firm, said that Adobe failed to use best practices for securing the passwords and has not salted them. Another security firm, Sophos, showed that Adobe used a weak encryption method permitting the recovery of a lot of information with very little effort. According to IT expert Simon Bain, Adobe has failed its customers and 'should hang their heads in shame'. Many of the credit cards were tied to the Creative Cloud software-by-subscription service. Adobe offered its affected US customers a free membership in a credit monitoring service, but no similar arrangements have been