MyRecon OSINT← Case Files · The Breach Files
Ashley Madison, 2015: when the data itself was the weapon
- People affected
- 32 million user records
- When it happened
- July 2015
- Made public
- 19 July 2015; data published 18–20 August 2015
- How they got in
- Never publicly established; the attackers claimed insider-level access
- Attributed to
- A group calling itself The Impact Team. Never identified.
- What it cost
- $1.6 million FTC and state settlement, $11.2 million class settlement, the chief executive's job
What was exposed: Names · Email addresses · Home addresses · Partial card data and transaction records · Sexual preferences stated on profiles · bcrypt password hashes, plus a weak legacy token
Every other case file here is about data being stolen for money. Ashley Madison is the one where the data was taken in order to be published, by people who wanted the exposure itself to be the punishment — and it is the clearest demonstration that the harm from a breach is not always fraud. Sometimes it is simply that someone now knows.
What happened
On 19 July 2015, visitors to Ashley Madison — a dating service built explicitly around extramarital affairs, owned by Toronto-based Avid Life Media — were shown a message from a group calling itself The Impact Team. It claimed to have the company's full customer database and demanded that Ashley Madison and a sister site, Established Men, be taken offline permanently. This was not a ransom in the usual sense: there was no price. The demand was that the business cease to exist.
Avid Life Media did not comply. On 18 and 20 August, the attackers published, in two releases: roughly 32 million user records, internal company documents, source code, and the chief executive's email archive. It was posted openly and mirrored instantly. Within days, searchable web front-ends existed for anyone to check a name or an email address.
The password story
Ashley Madison did something most breached companies of that era did not: it stored passwords with bcrypt at a high cost factor. That is real, correct password hashing — slow by design, salted per user, resistant to large-scale cracking. For a few weeks after the dump, the passwords held.
Then the second copy was found. Researchers working through the leaked source code found a legacy authentication token that had been generated from an MD5 hash of the username and password, lowercased. MD5 is fast and the token was effectively a weaker duplicate of the same secret. Around 11 million passwords fell almost immediately. The lesson is one that recurs in modern breaches: your password storage is only as strong as the weakest place that secret exists in your system, including the old code path nobody remembers.
The parts that were not technical
Two findings from the joint Canadian and Australian privacy investigation stand out, because neither is about hackers.
The paid deletion that did not delete. Ashley Madison sold a "full delete" option: pay a fee, and your profile and data are removed. Regulators found the deletion was incomplete — the company retained information, including payment records, after taking money to erase it. Selling a privacy promise you do not keep converts a security incident into a deception case.
The fabricated trust mark. The site displayed a security award icon that no one had awarded it. Investigators found it had been created in-house. It is a small detail that tells you a great deal about how seriously the underlying controls were taken.
And one more, which changes how the leaked list should be read: the service never verified email addresses at registration. Anyone could sign up with anyone's address. This is why the widely reported presence of government and military addresses in the file proved so little, and why treating the dump as a list of confirmed users was wrong from the first day.
The human cost
This is the part that separates Ashley Madison from every other entry in this archive. Within days of publication, extortion emails began arriving at addresses in the file — pay, or your spouse, employer and contacts get told. Some of the recipients had never used the service. It did not matter, because the accusation was the weapon.
In Canada, police investigating the case reported suicides connected to the leak. A police captain in San Antonio took his own life days after the data appeared. Divorces, resignations and family breakdowns followed through the rest of the year, and in countries where same-sex relationships or adultery are criminalised, the exposure carried legal danger rather than social embarrassment.
No fraud occurred in any of that. Nobody's money was stolen. The damage was done entirely by the fact of publication.
The timeline
- 19 July 2015 — The Impact Team announces the breach and demands the site be shut down.
- 18 and 20 August — Around 32 million user records, internal documents and the CEO's emails are published.
- Late August — Extortion emails begin; searchable lookup sites appear; the first reported suicides.
- 28 August — Chief executive Noel Biderman leaves the company.
- September 2015 — Researchers recover roughly 11 million passwords through the legacy MD5 token.
- August 2016 — Canadian and Australian privacy commissioners publish joint findings: inadequate security framework, retained data after paid deletion, a fabricated security trust mark.
- December 2016 — FTC and 13 states settle for $1.6 million against a suspended $17.5 million judgment.
- 2017 — An $11.2 million class-action settlement is approved in the United States.
What it changed
Sensitivity entered the risk calculation properly. Before Ashley Madison, breach severity was largely measured in identity-theft terms: how many card numbers, how many national identifiers. This case forced a second axis — what does this data imply about a person, and what happens to them if it is published? That axis now drives how health data, sexual-orientation data and location history are classified, and it is why the breach archive weights those fields the way it does.
Deletion became auditable. "Delete my account" stopped being a UI affordance and became a claim regulators will test. The right to erasure written into the GDPR two years later has a very similar shape to the finding against Avid Life Media.
Unverified email addresses became a liability. Letting anyone register any address seemed harmless while the database was private. In a published dump it implicated people who had never visited the site, and there was no way to un-ring that bell.
If you were in it, or accused of being in it
- Presence in the file is not proof of use. Addresses were never verified. Anyone reading the dump as a membership list is reading it wrong.
- Do not pay extortion demands. The data has been public for a decade; payment buys nothing and marks you as responsive. Report the attempt to your national cybercrime reporting service.
- Change any password used there, and anywhere it was reused. Eleven million were recovered from the weak token path.
- Think about what else you have signed up to under your real address. The general lesson of this case is that a service's discretion policy does not survive its database being published — see how to find and shrink what is already out there.
Questions people ask
Were Ashley Madison passwords cracked?
Most were not, at first. The site used bcrypt with a high cost factor, which is genuinely strong password storage. But researchers then found a legacy authentication token in the code that had been generated from an MD5 hash of the lowercased username and password — a far weaker construction. That shortcut allowed roughly 11 million passwords to be recovered quickly. Strong hashing in one place does not help if a weaker copy of the same secret exists somewhere else in the codebase.
Did Ashley Madison really charge to delete data it kept?
It offered a paid "full delete" option, and regulators found that the deletion was not complete — payment records and other data were retained. Charging for a privacy guarantee that is not delivered is a consumer protection matter as much as a security one, and it was central to the FTC's case.
Were all the accounts real people?
No, and this matters for anyone reading a name in the dump. The site never verified email addresses at signup, so anyone could register any address — which is how government and military addresses ended up in the file without their owners' involvement. Regulators also found the service used automated engager profiles to interact with paying male users.
Was anyone caught?
No. The Impact Team was never identified, and no charges were ever brought. The company's chief executive resigned, the business was renamed Ruby Corp, and Ashley Madison continues to operate.
Sources
- Federal Trade Commission — Ashley Madison settlement, December 2016
- Joint report of the Privacy Commissioner of Canada and the Australian Privacy Commissioner, August 2016
- CynoSure Prime analysis of the legacy login token, September 2015
Read next
Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported — where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.