Hackers have released what appear to be sensitive and confidential details of 33m user accounts on the infidelity site Ashley Madison, including names, addresses, emails and information about their sexual preferences. The data from the website, whose tagline is “Life is short. Have an affair”, was released by hackers from the Impact Team cybergroup, and took the form of a 10GB database on the “dark web” that could be accessed through a specialised web browser called Tor.
One coder then created a site for internet users where it was possible to enter a specific email address to see if that matched a customer record, potentially allowing spouses to check whether their partners had an account on the controversial site.
Accounts appear to come from all around the world, including 1.2m in the UK, with email addresses from government, the military and large companies, although some of the emails used may be faked because Ashley Madison did not verify customer email addresses. More than 100 user accounts were registered with Ministry of Defence email addresses, and another 100-plus accounts were registered with emails ending in gov.uk, the general government domain, the Guardian can confirm.
A married SNP MP whose email address was among the millions released said she was the victim of a smear campaign. Michelle Thomson, the MP for Edinburgh West, said her identity was “harvested” by hackers. “I am not aware of, or in contact with … Ashley Madison, and look forward to finding out more about what has actually happened,” she said.
The leak also appeared to demonstrate that the “full delete” service run by Ashley Madison, which purported to charge users £15 to remove all their information from the dating site, did not work comprehensively. The leaked data included enough information to enable the easy identification of users. The company apparently retained the date of birth, city, state, postcode, country and gender of its former customers, plus information about their relationship status, what they were open to sexually, and what they were looking for in a partner.
The allegations that Ashley Madison’s full delete did not work as advertised are at the heart of the stated motivation for the site’s hack, which is thought to have taken place last month. The group that attacked the company said it was motivated by the fact that the full-delete option generated $1.7m (£1.1m) in revenue in 2014.
Ashley Madison was set up in 2001 by a Canadian entrepreneur, Noel Biderman, and courted controversy with its explicitly pro-infidelity stance. Its owner, Toronto-based Avid Life Media, said it was working with police and law-enforcement authorities in Canada and the US.
“This event is not an act of ‘hacktivism’, it is an act of criminality. It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities,” Avid Life Media said in a statement. “The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror, and executioner, seeing fit to impose a personal notion of virtue on all of society.”
A second database leaked by the hackers also demonstrated that senior staff at the site were raising concerns over its security procedures as recently as June. The leaked internal documents show one company vice-president raising concerns over “a lack of security awareness across the organisation”. One was a summary of results of an internal questionnaire, in which employees were asked to list “critical success factors” in their jobs, the areas where “failure to perform well” would hurt them most, and the area where they would “hate to see something go wrong”.
Biderman, the company’s chief executive, wrote in the section on what he would hate to see go wrong: “Data exfiltration [stealing], confidentiality of the data. An insider data breach would be very harmful. Have we done a good enough job vetting everyone? Are we on top of it?”
Biderman’s response was dated 17 June 2015. Just one month later the attackers stole the user database and demanded that Ashley Madison and its sister site, Established Men, be taken offline, threatening to release the personal information in 30 days if their conditions were not met.
In his initial response to the attack, Biderman implied that his greatest fear – an insider data breach – was what had happened. “We’re on the doorstep of [confirming] who we believe is the culprit,” he told a cybersecurity journalist, Brian Krebs, in July. “I’ve got their profile right in front of me, all their work credentials. It was definitely a person here who was not an employee, but certainly had touched our technical services.”
The personal data that was taken from Ashley Madison is partially protected. But information such as addresses, credit card details and sexual preferences is stored in plain text in the database.
The company condemned the attack, but stopped short of verifying that the information leaked online was genuine. In a statement after the data was made public, the company said: “We will continue to put forth substantial efforts into removing any information unlawfully released to the public, as well as continuing to operate our business.”