Site’s hackers claim 37m personal records have been stolen from notorious dating site, with Cougar Life and Established Men also compromised
Hackers have stolen and leaked personal information from online cheating site Ashley Madison, an international dating site with the tagline: “Life is short. Have an affair.”
The site, which encourages married users to cheat on their spouses and advertises 37 million members, had its data hacked by a group calling itself the Impact Team. At least two other dating sites, Cougar Life and Established Men, also owned by the same parent group, Avid Life Media, have had their data compromised.
The Impact Team claims to have complete access to the company’s database, including not only user records for every single member, but also the financial records of ALM and other proprietary information. For now, the group has released just 40MB of data, including credit card details and several ALM documents.
According to the information security journalist Brian Krebs, who broke the news, ALM has confirmed that the hacked material is genuine, and the company is working to remove from the net the material that has already been posted. But the initial leak is just a taster, according to the Impact Team, which accompanied the data with a manifesto threatening release of further information if Ashley Madison and Established Men are not permanently closed.
“Avid Life Media has been instructed to take Ashley Madison and Established Men offline permanently in all forms, or we will release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails. The other websites may stay online,” the group’s statement reads.
The hackers’ main point of contention is with the fact that Ashley Madison charges users a fee of £15 to carry out a “full delete” of their information if they decide to leave the site. Although users have the option of permanently hiding their profile free of charge, the company’s advertisements claim that the full delete service is the only way to completely remove their information from the servers.
But the hackers say that that claim is “a complete lie”.
“Users almost always pay with credit card; their purchase details are not removed as promised, and include real name and address, which is of course the most important information the users want removed,” they allege.
ALM believes it has identified the perpetrator of the hack, which it says was likely an inside job. “We’re on the doorstep of [confirming] who we believe is the culprit, and unfortunately that may have triggered this mass publication,” the company’s chief executive, Noel Biderman, told Krebs. “I’ve got their profile right in front of me, all their work credentials. It was definitely a person here that was not an employee but certainly had touched our technical services.”
The data dump seems to back-up that theory to a certain extent, specifically apologising to the company’s director of security. “You did everything you could, but nothing you could have done could have stopped this,” the manifesto reads.
In a statement, ALM said: “We apologise for this unprovoked and criminal intrusion into our customers’ information. The current business world has proven to be one in which no company’s online assets are safe from cyber-vandalism, with Avid Life Media being only the latest among many companies to have been attacked, despite investing in the latest privacy and security technologies.
“At this time, we have been able to secure our sites, and close the unauthorised access points. We are working with law enforcement agencies, which are investigating this criminal act. Any and all parties responsible for this act of cyber–terrorism will be held responsible.”
Ashley Madison, along with a number of other dating sites, had already been criticised for the lack of care taken over customer information at least once before. In 2012, the online rights campaign group EFF examined eight popular dating sites, and found that just one, Zoosk, carried out simple security precautions such as enabling encrypted connections by default. In the EFF’s study, however, Ashley Madison was explicitly praised for deleting data after users closed their account.
ALM later said it had used the Digital Millennium Copyright Act (DCMA) to demand the removal of online posts about the incident “as well as all personally identifiable information about our users published online.”
Posts on Twitter which had apparently earlier linked to pages containing hacked material were now bringing up “page not found” results, the Guardian found.
ALM also said it is now offering its full-delete option free to any customer to help them protect their privacy.
