This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/technology/2015/aug/19/ashley-madisons-paid-delete-option-left-data-identifying-users-post-claims

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
Ashley Madison database suggests paid-delete option left some data intact Ashley Madison database suggests paid-delete option left identifiable data intact
(35 minutes later)
The hacked infidelity site Ashley Madison apparently retained enough personal data about users to identify them to spouses – as the site’s hackers have claimed – despite offering a paid-for “full delete” service, which charged users £15 or $20 to remove all their information.The hacked infidelity site Ashley Madison apparently retained enough personal data about users to identify them to spouses – as the site’s hackers have claimed – despite offering a paid-for “full delete” service, which charged users £15 or $20 to remove all their information.
On the database of Ashley Madison accounts, which was posted online by the hackers on Wednesday, accounts that had been wiped by the dating service had their real name, username, email and profile information removed as promised. But the company seems to have retained the date of birth, city, state, post- or zip code, country, gender, ethnicity, weight, height, body type and whether the user smokes or drinks – providing enough information to reveal a user’s identity.On the database of Ashley Madison accounts, which was posted online by the hackers on Wednesday, accounts that had been wiped by the dating service had their real name, username, email and profile information removed as promised. But the company seems to have retained the date of birth, city, state, post- or zip code, country, gender, ethnicity, weight, height, body type and whether the user smokes or drinks – providing enough information to reveal a user’s identity.
It also retained what kind of relationship a user was seeking, their current relationship status, what they were open to sexually, what turned them on, and what they were looking for in a partner. For instance, one user marked as having paid for their account to be deleted can be tracked to a specific tower block in London, where knowledge of their date of birth and appearance would easily identify them to friends or spouses.It also retained what kind of relationship a user was seeking, their current relationship status, what they were open to sexually, what turned them on, and what they were looking for in a partner. For instance, one user marked as having paid for their account to be deleted can be tracked to a specific tower block in London, where knowledge of their date of birth and appearance would easily identify them to friends or spouses.
The information security firm Rapid7, however, warned about individuals drawing damaging conclusions from the data. Tod Beardsley, the company’s security engineering manager, told the Guardian: “It’s trivial to set up a fake account on Ashley Madison, since Avid Life Media’s [owner of Ashley Madison] account setup procedures encourages, but does not require, an email address to be verified by the user. This might be done for a variety of reasons by actors ranging from pranksters to bitter divorce rivals.The information security firm Rapid7, however, warned about individuals drawing damaging conclusions from the data. Tod Beardsley, the company’s security engineering manager, told the Guardian: “It’s trivial to set up a fake account on Ashley Madison, since Avid Life Media’s [owner of Ashley Madison] account setup procedures encourages, but does not require, an email address to be verified by the user. This might be done for a variety of reasons by actors ranging from pranksters to bitter divorce rivals.
“Second, the majority of ‘real’ account holders tend to use fake, throwaway data and details, for obvious reasons. If some of those fake details happen to coincide with a real person, then it can create a sticky problem for that real person. Finally, even if the real data is a real person, and that person really registered for the site, there is no indication in the data if that person was successful at, or even intending to, pursue an illicit affair.”“Second, the majority of ‘real’ account holders tend to use fake, throwaway data and details, for obvious reasons. If some of those fake details happen to coincide with a real person, then it can create a sticky problem for that real person. Finally, even if the real data is a real person, and that person really registered for the site, there is no indication in the data if that person was successful at, or even intending to, pursue an illicit affair.”
The allegations that Ashley Madison’s “full delete” was nothing of the sort lie at the heart of the hackers’ assault on the site. The group that attacked the company, calling themselves the “Impact Team”, said that they were motivated by the fact that “Full Delete netted Avid Life Media $1.7m [about £1m] in revenue in 2014. It’s also a complete lie … Too bad for ALM, you promised secrecy but didn’t deliver.” The hackers demanded that Ashley Madison remove itself from the internet, or warned that they would release the stolen data. The allegations that Ashley Madison’s “full delete” was nothing of the sort lie at the heart of the hackers’ assault on the site. The group that attacked the company, calling themselves the “Impact Team”, said that they were motivated by the fact that “Full Delete netted Avid Life Media $1.7m [£1.1m] in revenue in 2014. It’s also a complete lie … Too bad for ALM, you promised secrecy but didn’t deliver.” The hackers demanded that Ashley Madison remove itself from the internet, or warned that they would release the stolen data.
Ashley Madison has not replied to a request for comment on retaining information on users who paid for a full deletion.Ashley Madison has not replied to a request for comment on retaining information on users who paid for a full deletion.