Ashley Madison 2015: The Breach That Leaked 32 Million Accounts

In July 2015, a group calling itself the Impact Team announced that it had broken into the systems of Avid Life Media, the company behind the dating website Ashley Madison, which was marketed to people seeking affairs. A month later, it published a large archive of the stolen data. The breach had personal and sometimes tragic consequences for users, and it became a lasting case study in privacy failures.

What happened

In July 2015 the Impact Team posted a message demanding that Avid Life Media shut down Ashley Madison and a sister site, Established Men, and threatened to release customer data if it did not. The company did not comply, and on 18 August the group released a first large data dump. Further files followed days later, including internal company emails and source code.

The data included roughly 32 million user accounts, with email addresses, names, partial payment information, and in many cases the profile details and preferences that users had entered. The company's chief executive, Noel Biderman, left in August 2015.

The "full delete" problem

One of the Impact Team's stated complaints was that the site charged a fee, around 19 US dollars, for a "full delete" service that was supposed to remove all of a user's data. The group said the service did not truly delete everything, and that it kept some personal information including payment details. Regulators later looked at the same issue. The point is hard to miss: people paid to have data removed, and it remained.

Passwords: a mixed picture

Ashley Madison stored most account passwords using bcrypt, a strong hashing algorithm designed to be slow, which made mass cracking difficult. Researchers later found, however, that a separate component of the system had stored login tokens using a much weaker method based on MD5 hashes. For users whose tokens were derived from the same information, this gave attackers a far quicker route to guess passwords. It is a good illustration of how a strong measure in one place can be undermined by a weak one in another.

Fallout and regulation

The consequences extended beyond embarrassment. Authorities in Canada and Australia carried out a joint investigation and found that the company had inadequate security safeguards, retained information for too long, and had misleading practices. In the United States, the Federal Trade Commission reached a settlement in December 2016 with Ruby Corp, the successor to Avid Life Media, over deceptive practices and failing to protect personal information. The settlement amount was reduced because the company could not pay the full sum. Lawsuits from users were also settled.

Some people who were exposed faced blackmail attempts, in which scammers emailed users and demanded money to keep their membership secret. Reports from the period also described personal and family consequences, and Toronto police said they had received reports of two unconfirmed suicides linked to the leak.

Lessons in data handling

• Delete means delete. If you promise to remove data, check that it is removed from databases, backups and logs.
• Keep less. Data you do not hold cannot be stolen.
• Hash passwords properly, everywhere. One weak shortcut can undo careful work.
• Know your risk. The more sensitive the information, the higher the standard of protection people expect.

Sensitive data raises the bar

The reaction to the leak was so strong because of what the data revealed. Membership of a dating site for people seeking affairs is sensitive in a way that a newsletter subscription is not. The case showed that the duty of care grows with the sensitivity of the information. A website that handles health details, financial data, political views, relationship information or anything else that could harm a person if exposed needs a higher standard of security than a simple brochure site.

Many people had also used their real work or home email addresses to sign up, which let others check whether particular individuals were members. Sites that allow sign-up without verifying email ownership, or that reveal whether an address is registered, can create similar problems on a smaller scale. A good design avoids confirming membership to strangers.

Cleaning up your own data

A practical way to apply this is to run a small data audit. List every place your site stores personal information: the database, form plugin entries, email inboxes that receive form messages, exports on your computer and backups. For each one, decide how long it is needed and who can open it. Many small sites discover that contact form messages from years ago are still sitting in several places, none of which anyone has looked at since.

The practical lesson for site owners

If your website collects personal information, be honest and precise about what you keep and for how long, and build a real process for deletion requests. Use a CMS or framework that hashes passwords with a modern algorithm, and make sure nothing in your stack uses older shortcuts for tokens or session data. Encrypt connections and limit who can export user lists.

Privacy rules in Europe give people the right to ask you to erase their data, so a clear process is not optional for many sites. Our security page covers the protection available on our plans, and the knowledge base explains how to remove old data from your hosting account.