Ashley Madison: Breach exposed 36 million user accounts

Hackers published data from about 36 million Ashley Madison accounts in 2015. Regulators in Canada and Australia found inadequate security, and the operator paid $1.6 million in a US settlement.

What happened

In July 2015 a group calling itself "The Impact Team" announced it had hacked Avid Life Media, the company behind Ashley Madison. In August 2015 it published data from about 36 million user accounts, including profile details, email addresses and some billing information. A joint investigation by the privacy regulators of Canada and Australia found that the company lacked documented security policies, a risk management process and adequate staff training. It also used single-factor remote access and kept passwords and keys in plain text. The regulators also criticised it for keeping data indefinitely and charging users to delete it. In December 2016 the operators settled US Federal Trade Commission (FTC) and state charges. They agreed to a security programme and paid $1.6 million.

What is documented

• Office of the Privacy Commissioner of Canada and the Australian Information Commissioner: safeguards inadequate; contraventions of Canadian and Australian privacy law; a compliance agreement and an enforceable undertaking were accepted (August 2016).
• The same report: affected users received extortion emails after the leak.
• FTC: the operators settled charges of deceptive and unfair security practices, including keeping data from users who had paid $19 for a "Full Delete"; $1.6 million paid in total (December 2016).

What has not been established

• Who was behind the attack.
• The full extent of what the attackers accessed, because logs were erased.

What this means for you

1. Sign up for sensitive services with a separate email address that does not reveal your name.
2. Check how a service deletes your data before you sign up, and whether deletion costs money.
3. If you receive a blackmail email after a leak, do not pay; report it to the police.