Ashley Madison data breach

In July 2015, an unknown group hacked the user data of Ashley Madison, a commercial website for people seeking extramarital affairs. The hackers, who called themselves "The Impact Team", claimed to have stolen personal information about the site's user base, and threatened to release users' names and personally identifying information if Ashley Madison was not immediately shut down. On August 18 and August 20, the group leaked more than 25 gigabytes of company data, including user details.

Because of the site's policy of not deleting users' personal information – including real names, home addresses, search history and credit card transaction records – many users feared being publicly shamed.

Timeline of data breach

The Impact Team announced the attack on July 15, 2015, and threatened to expose the identities of Ashley Madison's users if its parent company, Avid Life Media, did not shut down Ashley Madison and its sister site, "Established Men".

On July 20, 2015, the website put up three statements under its "Media" section addressing the breach. The website's normally busy Twitter account fell silent apart from posting the press statements. One statement read: "At this time, we have been able to secure our sites, and close the unauthorized access points. We are working with law enforcement agencies, which are investigating this criminal act. Any and all parties responsible for this act of cyber–terrorism will be held responsible. Using the Digital Millennium Copyright Act (DMCA), our team has now successfully removed the posts related to this incident as well as all Personally Identifiable Information (PII) about our users published online." The site also offered to waive the account deletion charge.

On July 21, it was reported that hackers claimed to have released 2,500 customer records, although Ashley Madison spokespeople denied this, and stated only two names were released.

On August 18, the hacker group posted the raw data on a Dark Web site only accessible via the hidden (or "Onion") services of the anonymity network Tor, with a message and link to a compressed bit torrent file containing nearly 10 gigabytes of data. Uncompressed, it amounts to at least 60 gigabytes of data. Experts confirmed the validity of the information released, and furthermore the data release was cryptographically signed with a PGP public key. In its message, the group blamed Avid Life Media, accusing the company of deceptive practices: "We have explained the fraud, deceit, and stupidity of ALM and their members. Now everyone gets to see their data ... Too bad for ALM, you promised secrecy but didn't deliver."

In response, Ashley Madison posted a message on its website stating that the company was working with authorities to investigate. The company also condemned the hackers, stating they were not "hacktivists" but criminals: "It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities. The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror, and executioner, seeing fit to impose a personal notion of virtue on all of society. We will not sit idly by and allow these thieves to force their personal ideology on citizens around the world."

A second, larger, data dump, occurred on August 20, 2015, the largest file of which comprised 12.7 gigabytes of corporate emails, including those of Noel Biderman, the CEO of Avid Life Media.

Passwords

Analysis of passwords used on the site showed that "123456" and "password" were the most commonly used passwords.

Ethics of leak and reporting

None of the accounts on the website need email verification for the profile to be created, meaning that people often create profiles with fake email addresses, and sometimes people who have similar names accidentally confuse their email address, setting up accounts for the wrong email address. Ashley Madison's company required the owner of the email account to pay money to delete the profile, preventing people who had accounts set up against their consent (as a workplace prank or mistyped email) from deleting them without paying. Hackers allege that Avid Life Media received $1.7 million a year from people paying to shut down user profiles created on the site, which included profiles created as a prank. The company falsely asserted that paying them would "fully delete" the profiles - which the hack proved was untrue.

Following the hack, communities of Internet vigilantes began combing though to find famous individuals to publicly humiliate them. France24 reported that 1,200 Saudi Arabian .sa email addresses were in the leaked database, and in Saudi Arabia adultery can be punished with death. Several thousand U.S. .mil and .gov email addresses were registered on the site. In the days following the breach, extortionists began targeting people whose details were included in the leak, attempting to scam over $200 US worth of Bitcoins from them. One company started offering a "search engine" where people could type email addresses of colleagues or their spouse into the website, and if the email address was on the database leak, then the company would send them letters threatening that their details were to be exposed unless they paid money to the company.

A variety of security researchers and Internet privacy activists debated the media ethics of journalists reporting on the specifics of the data, such as the names of users revealed to be members. A number of commentators compared the hack to the loss of privacy during the 2014 celebrity photo hack.

Clinical psychologists argued that dealing with an affair in a particularly public way increases the hurt for spouses and children. Carolyn Gregoire argued that "Social media has created an aggressive culture of public shaming in which individuals take it upon themselves to inflict psychological damage" and that more often than not, "the punishment goes beyond the scope of the crime." Graham Cluley argued that the psychological consequences for people shamed could be immense, and that it would be possible for some to be bullied into suicide.

Suicides

On August 24, 2015, Toronto police announced that two unconfirmed suicides had been linked to the data breach, in addition to "reports of hate crimes connected to the hack." Unconfirmed reports say a man in the U.S. died by suicide.

Notable public figures identified

After Gawker posted images linking a credit card with Josh Duggar, made famous by the reality television series 19 Kids and Counting, he and his parents released a statement in which Josh admitted to watching pornography on the Internet and being unfaithful to his wife. According to the material obtained in the data breach, Duggar paid $986.76 for two Ashley Madison subscriptions starting on February 2013, which were cancelled in May 2015 shortly after previous molestation allegations against Duggar had surfaced.

Hamza Tzortzis, a conservative Islamic preacher who promoted iERA was allegedly on the list, but Tzortzis has denied that the account belonged to him, and filed a formal complaint with the police over an alleged hack of his bank details.

Lawsuit

The organization behind Ashley Madison faces a $576m class-action lawsuit from users whose details were leaked. Two Canadian firms - Charney Lawyers and Sutts, Strosberg LLP - are bringing the action against site owners Avid Dating Life and Avid Media.

See also

• Internet vigilantism
• Online shaming