As the investigation continues, we'll be interested to see how things pan out. 38 million is a lot of accounts to have compromised. And while the data is encrypted, that's not always enough to stop tenacious hackers. For what it's worth, though, we have no reason to believe Adobe was trying to deceive anyone with the original number of 3 million. Attacks like this can be monstrously complex, so finding out new information isn't out of the norm.