This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/technology/2015/aug/19/ashley-madisons-hacked-customer-files-posted-online-as-threatened-say-reports

The article has changed 7 times. There is an RSS feed of changes available.

Version 3 Version 4
Ashley Madison hack: customer files posted online as per threat, say reports Ashley Madison condemns attack as experts claim hacked database is real
(about 4 hours later)
Hackers have released what they claim to be the personal information, including names, email addresses, phone numbers and partial credit card numbers of 37 million users of the infidelity site Ashley Madison.
Ashley Madison condemned the attack but stopped short of verifying the information leaked online was genuine.
The data release will inevitably lead to anxious partners attempting to search for the names or email addresses of people they suspect may have used the site, whose tagline is “Life is short. Have an affair”.
Related: I don’t regret my Ashley Madison affair – the site helped me to live again | AnonymousRelated: I don’t regret my Ashley Madison affair – the site helped me to live again | Anonymous
Hackers say they have followed through on a threat to release stolen customer information from the cheating spouses website AshleyMadison.com. The 10 gigabyte database file was released to BitTorrent and the dark web on Tuesday night and includes email and postal addresses, user descriptions, weight and height, encrypted passwords, partial credit card numbers and transaction details.
The data was initially posted on to the “dark web”, reports said, making it only accessible using a specialised browser, although lists of email addresses appeared on other sites afterwards. The authenticity could not immediately be confirmed. The Guardian confirmed that the email address and details of a Guardian journalist who had used Ashley Madison as part of an investigation is in the database released on Tuesday night.
The hackers, who called themselves Impact Team and stole the user database in an attack in July, demanded that Ashley Madison and its sister site Established Men, both owned by Toronto-based Avid Life Media, be taken offline, threatening to release the personal information in 30 days if their conditions were not met.
“Avid Life Media has failed to take down Ashley Madison and Established Men. We have explained the fraud, deceit and stupidity of ALM and their members. Now everyone gets to see their data,” said Impact Team in a statement released with the Ashley Madison data.
Ashley Madison said: “This event is not an act of hacktivism, it is an act of criminality. It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities.”
“The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror and executioner, seeing fit to impose a personal notion of virtue on all of society. We will not sit idly by and allow these thieves to force their personal ideology on citizens around the world.”
Related: In the Ashley Madison era, marriage needs a rethink | Gaby HinsliffRelated: In the Ashley Madison era, marriage needs a rethink | Gaby Hinsliff
A group calling itself Impact Team had leaked snippets of the compromised data in July and threatened to publish names and salacious details about clients unless Ashley Madison and EstablishedMen.com, another site owned by Toronto-based parent company Avid Life Media, were taken down. Data appears authentic
Related: FDA approves 'female Viagra' pill Flibanserin after two rejections Several security researchers have been analysing the data and are suggesting that the database is real and contains the personal details of real Ashley Madison members.
Tech website Wired said 9.7 gigabytes of data was posted and appeared to include member account and credit card details. “I’ve now spoken with three vouched sources who all have reported finding their information and last four digits of their credit card numbers in the leaked database,” said Brian Krebs, who broke the news of the original hack.
“Avid Life Media has failed to take down Ashley Madison and Established Men,” Wired quoted Impact Team as saying in a statement accompanying the online dump. Rob Graham, researcher from Errata security, said he was still analysing the leaked data but agreed that “it appears legit. I asked my Twitter followers for those who had created accounts. I have verified multiple users of the site, one of which was a throwaway account used only on the site. Assuming my followers aren’t lying, this means the dump is confirmed.”
“We have explained the fraud, deceit, and stupidity of ALM [Avid Life Media] and their members. Now everyone gets to see their data,” the hackers said, according to Wired. The debate about the authenticity of the Ashley Madison breach is as good as over, too many independent points of verification to be fake.
Avid Life, which uses the slogan “Life is short. Have an affair”, condemned the hackers, saying they had appointed themselves as “the moral judge, juror, and executioner, seeing fit to impose a personal notion of virtue on all of society”. Fake accounts and leaked emails
“These are illegitimate acts that have real consequences for innocent citizens who are simply going about their daily lives,” said a company statement. Ashley Madison did not confirm whether the leaked data was legitimate, but said: “We are actively monitoring and investigating this situation to determine the validity of any information posted online and will continue to devote significant resources to this effort.”
“Regardless, if it is your private pictures or your personal thoughts that have slipped into public distribution, no one has the right to pilfer and reveal that information to audiences in search of the lurid, the titillating, and the embarrassing.” At one stage Ashley Madison did not verify email addresses for new user accounts, which allowed the creation of many fake accounts, including those of high profile politicians.
Avid Life said it had asked the FBI to investigate, as well as the Royal Canadian Mounted Police, the Ontario Provincial Police and Toronto Police. “I could have created an account at Ashley Madison with the address of barack.obama@whitehouse.gov, but it wouldn’t have meant that Obama was a user of the site,” explained independent security researcher Graham Cluley.
Within the database appears to be over 10,000 US military email addresses and 100s of US government addresses. A collection of internal Ashley Madison communications were also included, which appear to suggest that the site’s senior staff were concerned about the possibilities of a hacking attack.
George Anderson, director at cybersecurity firm Webroot, said: “While readers’ morals may conflict either seeing this group of hackers as good or bad guys, the fact remains that Impact Team illegally obtained sensitive personal info.
I’d imagine the fallout is divorces, firings and blackmail – really personally malicious and upsetting stuff. There are no moral judgments on this except the immorality of hackers. So the ‘what now?’ is pretty nasty and the site users will probably be considering a class action for negligence.”
• What happened when I tried to delete my Ashley Madison account
• Ashley Madison customer service in meltdown as site battles hack fallout