Home   >   News   >   Infidelity Site Ashley Madison Hacked

Infidelity Site Ashley Madison Hacked

By on August 20, 2015

Hackers have released what they claim to be personal information, reports The Guardian, including names, email addresses, phone numbers and partial credit card numbers of 37 million users of the infidelity site Ashley Madison.

Ashley Madison condemned the attack but stopped short of verifying the information leaked online was genuine.

The data release will inevitably lead to anxious partners attempting to search for the names or email addresses of people they suspect may have used the site, whose tagline is “Life is short. Have an affair”.

The 10 gigabyte database file was released on BitTorrent and the dark web on Tuesday night and includes email and postal addresses, user descriptions, weight and height, encrypted passwords, partial credit card numbers and transaction details.

The Guardian confirmed that the email address and details of a Guardian journalist who had used Ashley Madison as part of an investigation is in the database released on Tuesday night.

The hackers, who called themselves Impact Team and stole the user database in an attack in July, demanded that Ashley Madison and its sister site Established Men, both owned by Toronto-based Avid Life Media, be taken offline, threatening to release the personal information in 30 days if their conditions were not met.

“Avid Life Media has failed to take down Ashley Madison and Established Men. We have explained the fraud, deceit and stupidity of ALM and their members. Now everyone gets to see their data,” said Impact Team in a statement released with the Ashley Madison data.

Ashley Madison said: “This event is not an act of hacktivism, it is an act of criminality. It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities.”

“The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror and executioner, seeing fit to impose a personal notion of virtue on all of society. We will not sit idly by and allow these thieves to force their personal ideology on citizens around the world.”

Several security researchers have been analysing the data and are suggesting that the database is real and contains the personal details of real Ashley Madison members.

“I’ve now spoken with three vouched sources who all have reported finding their information and last four digits of their credit card numbers in the leaked database,” said Brian Krebs, who broke the news of the original hack.

Rob Graham, researcher from Errata security, said he was still analysing the leaked data but agreed that “it appears legit. I asked my Twitter followers for those who had created accounts. I have verified multiple users of the site, one of which was a throwaway account used only on the site. Assuming my followers aren’t lying, this means the dump is confirmed.”

Ashley Madison did not confirm whether the leaked data was legitimate, but said: “We are actively monitoring and investigating this situation to determine the validity of any information posted online and will continue to devote significant resources to this effort.”

At one stage Ashley Madison did not verify email addresses for new user accounts, which allowed the creation of many fake accounts, including those of high profile politicians.

“I could have created an account at Ashley Madison with the address of barack.obama@whitehouse.gov, but it wouldn’t have meant that Obama was a user of the site,” explained independent security researcher Graham Cluley.

Within the database appears to be over 10,000 US military email addresses and 100s of US government addresses. A collection of internal Ashley Madison communications were also included, which appear to suggest that the site’s senior staff were concerned about the possibilities of a hacking attack.

George Anderson, director at cybersecurity firm Webroot, said: “While readers’ morals may conflict either seeing this group of hackers as good or bad guys, the fact remains that Impact Team illegally obtained sensitive personal info.

I’d imagine the fallout is divorces, firings and blackmail – really personally malicious and upsetting stuff. There are no moral judgments on this except the immorality of hackers. So the ‘what now?’ is pretty nasty and the site users will probably be considering a class action for negligence.”

Source: The Guardian

You must be logged in to post a comment Login