Ashley Madison data breach

Impact and ethics

None of the accounts on the website need email verification to create a profile, meaning that people often create profiles with fake email addresses. Ashley Madison's company required the owner of the email account to pay money to delete the profile, preventing people who had accounts set up without their consent (as a prank or mistyped email) from deleting them without paying. Hackers allege that Avid Life Media received $1.7 million a year from people paying to shut down user profiles created on the site. The company falsely asserted that paying them would "fully delete" the profiles, which the hack proved was untrue.

Josh Duggar, a 27-year-old man who had become famous as a teenage member of a conservative Christian family featured on a reality television series named 19 Kids and Counting, was one notable user of Ashley Madison whose data was breached. The released data included records of nearly $1,000 of transactions on a credit card account in his name. The news of the data release compounded his problems with revelations earlier that year about police reports of his sexual misconduct; on 20 August, he admitted he had been unfaithful to his wife. The data breach had quickly followed the release of a past police report alleging that he had fondled five underaged girls, including a few of his own sisters. On 25 August, he checked himself into a rehabilitation center.

Following the hack, communities of internet vigilantes began combing through to find famous individuals whom they planned to publicly humiliate. France24 reported that 1,200 Saudi Arabian '.sa' email addresses were in the leaked database, which were further extortionable since adultery is punishable via death in Saudi Arabia. Several thousand U.S. .mil and .gov email addresses were registered on the site. In the days following the breach, extortionists began targeting people whose details were included in the leak, attempting to scam over US$200 worth of Bitcoins from them. One company started offering a "search engine" where people could type email addresses of colleagues or their spouse into the website, and if the email address was on the database leak, then the company would send them letters threatening that their details were to be exposed unless they paid money to the company.

A variety of security researchers and internet privacy activists debated the media ethics of journalists reporting on the specifics of the data, such as the names of users revealed to be members. A number of commentators compared the hack to the loss of privacy during the 2014 celebrity photo hack.

Clinical psychologists argued that dealing with an affair in a particularly public way increases the hurt for spouses and children. Carolyn Gregoire argued that "Social media has created an aggressive culture of public shaming in which individuals take it upon themselves to inflict psychological damage" and that more often than not, "the punishment goes beyond the scope of the crime." Graham Cluley argued that the psychological consequences for people shamed could be immense and that it would be possible for some to be bullied into suicide. Charles J. Orlando, who had joined the site to conduct research on women who cheat, wrote of his concern for the spouses and children of outed cheaters, saying that "the mob that is the Internet is more than willing to serve as judge, jury, and executioner" and that site members did not deserve "a flogging in the virtual town square with millions of onlookers".

On 24 August 2015, Toronto police announced that two unconfirmed suicides had been linked to the data breach, in addition to "reports of hate crimes connected to the hack". Unconfirmed reports say a man in the U.S. died by suicide. At least one suicide, which was previously linked to Ashley Madison, has since been reported as being due to "stress entirely related to issues at work that had no connection to the data leak". The same day, a pastor and professor at the New Orleans Baptist Theological Seminary killed himself citing the leak that had occurred six days before.

Users whose details were leaked filed a $567 million class-action lawsuit against Avid Dating Life and Avid Media, the owners of Ashley Madison, through Canadian law firms Charney Lawyers and Sutts, Strosberg LLP. In July 2017, the owner of Ruby Corp. announced the company would settle the lawsuit for $11.2 million. In a 2019 interview, Ashley Madison's chief strategy officer Paul Keable confirmed the installment of security features like two-factor verification, PCI compliance and fully-encrypted browsing as a consequence of the hacker attack from 2015.

Data analysis

Annalee Newitz, editor-in-chief of Gizmodo, analyzed the leaked data. They initially found that only roughly 12,000 (0.22%) of the 5.5 million registered female accounts were used regularly. The vast majority of accounts had been used only once — the day they were registered. Newitz also found that many women's accounts were created from the same IP address, suggesting there were many fake accounts. They found that women checked email messages very infrequently: every one time a woman checked her email, 13,585 men checked theirs. Only 9,700 of the 5.5 million female accounts had ever replied to a message, compared to the 5.9 million men who would do the same. They concluded, "The women's accounts show so little activity that they might as well not be there." In a subsequent article the following week Newitz acknowledged that they had "misunderstood the evidence" in their previous article and that their conclusion that there were few females active on the site had been based on data recording "bot" activities in contacting members. Newitz confirmed that Ashley Madison had created more than 70,000 female bots to send millions of fake messages to male users. Still, they note that "we have absolutely no data recording human activity at all in the Ashley Madison database dump from Impact Team. All we can see is when fake humans contacted real ones." They noted that the site seemed to keep track of human-to-human contact but that the Impact Team had not released this data.

Passwords on the live site were hashed using the bcrypt algorithm. A security analyst using the Hashcat password recovery tool with a dictionary based on the RockYou passwords found that among the 4,000 passwords that were the easiest to crack, "123456" and "password" were the most commonly used passwords on the live website. An analysis of old passwords on an archived version showed that "123456" and "password" were the most commonly used. Due to a design error where passwords were also hashed separately with the insecure algorithm MD5, 11 million passwords were eventually cracked.

While acknowledging that some men had detected the ruse, staff writer Claire Brownell of the Financial Post suggested that if only a few interactions were conducted, the Turing test could be passed by the women-imitating chatbots that had fooled many men into buying special accounts.

Popular culture

The data breach is the subject of the 2023 Hulu series The Ashley Madison Affair and the 2024 Netflix series Ashley Madison: Sex, Lies & Scandal.