This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/world/2015/jul/21/ashley-madison-adultery-site-hack-will-i-be-found-out-what-you-need-to-know

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
Ashley Madison adultery site hack: will I be found out? What you need to know Ashley Madison adultery site hack: will I be found out?
(35 minutes later)
The hacking of the dating site Ashley Madison has raised complex questions about online privacy and the safety of personal data but for the users of the site, which claims to have more than 33 million members in 46 countries, the questions are fairly straightforward: what are the chances my husband or wife will find my profile on the site, and what can I do to stop that happening? The hacking of the dating site Ashley Madison has raised complex questions about online privacy and the safety of personal data, but for the users of the site, which claims to have more than 33 million members in 46 countries, the questions are fairly straightforward: what are the chances my husband or wife will find my profile on the site, and what can I do to stop that happening?
This is what Ashley Madison customers, or anyone who shares intimate details about themselves on a dating website, need to know.This is what Ashley Madison customers, or anyone who shares intimate details about themselves on a dating website, need to know.
Related: Dating site hackers expose details of millions of usersRelated: Dating site hackers expose details of millions of users
I’ve been cheating on my spouse – will I be found out?I’ve been cheating on my spouse – will I be found out?
Your details probably are not available online yet – but they could be soon. The hackers who claimed responsibility, The Impact Team, said they would release “all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails” unless Ashley Madison and its sister site, Established Men, were taken offline. They did not give a deadline for this to happen, so a release could be imminent. Your details probably are not available online yet – but they could be soon. The hackers who claimed responsibility, the Impact Team, said they would release “all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails” unless Ashley Madison and its sister site, Established Men, were taken offline. They did not give a deadline for this to happen, so a release could be imminent.
In anticipation that the leak will eventually become public, you may want to take pre-emptive action and tell your other half. The relationship counselling service Relate would not say if it had been approached by worried Ashley Madison users, but it has issued general advice to people on how to break the news.In anticipation that the leak will eventually become public, you may want to take pre-emptive action and tell your other half. The relationship counselling service Relate would not say if it had been approached by worried Ashley Madison users, but it has issued general advice to people on how to break the news.
Denise Knowles, a Relate counsellor, said: “It’s good to offer an explanation as to why you thought the affair happened but it’s also important to take responsibility and to answer any questions they have truthfully. Denise Knowles, a Relate counsellor, said: “It’s good to offer an explanation as to why you thought the affair happened but it’s also important to take responsibility and to answer any questions they have truthfully. Try to think of your partner’s needs when you respond to their questions and remember that they’re likely to be in shock.”
“Try to think of your partner’s needs when you respond to their questions and remember that they’re likely to be in shock.”
Knowles said there was some hope for couples where one partner had been unfaithful. “Although some relationships never recover, others survive affairs and some people even find their relationship becomes stronger once they’ve worked things through,” she said.Knowles said there was some hope for couples where one partner had been unfaithful. “Although some relationships never recover, others survive affairs and some people even find their relationship becomes stronger once they’ve worked things through,” she said.
I think my spouse has been cheating – can I find out?I think my spouse has been cheating – can I find out?
Probably not yet. The Impact Team released just some snippets of data they had obtained, and much of it was internal company data including bank accounts and salary information, but they seem to intend to drip-feed informationfor as long as the sites stay online. Probably not yet. The Impact Team released just some snippets of data they had obtained, and much of it was internal company data including bank accounts and salary information, but they seem to intend to drip-feed information for as long as the sites stay online.
Ashley Madison said in a statement that it had used the US Digital Millennium Copyright Act to “successfully remove all personally identifiable information (PII) about users published online so far” and would continue to do so.Ashley Madison said in a statement that it had used the US Digital Millennium Copyright Act to “successfully remove all personally identifiable information (PII) about users published online so far” and would continue to do so.
The six places the hackers had initially shared their stolen information have since been scrubbed clean as a result, but their manifesto – which contains information about two apparently randomly selected users, one from Massachusetts and one from Ontario – is still online. The six places the hackers initially shared their stolen information have since been scrubbed clean as a result, but their manifesto – which contains information about two apparently randomly selected users, one from Massachusetts and one from Ontario – is still online.
Are all dating websites vulnerable?Are all dating websites vulnerable?
Only to the extent that almost any company could be struck by this sort of attack. According to Ashley Madison’s founder and chief executive, Noel Biderman, the hack itself was carried out by a third-party contractor, who had access to the company’s servers. Only to the extent that almost any company could be struck by this sort of attack. According to Ashley Madison’s founder and chief executive, Noel Biderman, the hack itself was carried out by a third-party contractor who had access to the company’s servers. “We’re on the doorstep of [confirming] who we believe is the culprit, and unfortunately that may have triggered this mass publication,” Biderman told a cyber-security reporter, Brian Krebs. “I’ve got their profile right in front of me, all their work credentials. It was definitely a person here who was not an employee but certainly had touched our technical services.”
“We’re on the doorstep of [confirming] who we believe is the culprit, and unfortunately that may have triggered this mass publication,” Biderman told a cyber-security reporter, Brian Krebs. “I’ve got their profile right in front of me, all their work credentials. It was definitely a person here, that was not an employee but certainly had touched our technical services.”
Insider threats are something that many companies, not just dating sites, are vulnerable to. Research from the security firm Centrify suggests that more than half of UK and US firms do not immediately block former employees’ access to critical systems, and a third of British IT managers told the researchers it would be easy for an ex-employee to log in and access systems with old passwords.Insider threats are something that many companies, not just dating sites, are vulnerable to. Research from the security firm Centrify suggests that more than half of UK and US firms do not immediately block former employees’ access to critical systems, and a third of British IT managers told the researchers it would be easy for an ex-employee to log in and access systems with old passwords.
But dating sites often have security weaknesses that an outsider can exploit as well. In 2012, the online rights campaign group EFF examined eight popular dating sites, and found that just one, Zoosk, carried out simple security precautions such as enabling encrypted connections by default.But dating sites often have security weaknesses that an outsider can exploit as well. In 2012, the online rights campaign group EFF examined eight popular dating sites, and found that just one, Zoosk, carried out simple security precautions such as enabling encrypted connections by default.
What can I do to mitigate the effects of the leak?What can I do to mitigate the effects of the leak?
Ashley Madison is now offering a free “full-delete” to any member, though that’s likely to be of little comfort to users, given the doubts about the effectiveness of deletion that were raised by the hackers. The site says that untrue and deletion is effective. Ashley Madison is now offering a free “full delete” to any member, though that’s likely to be of little comfort to users, given the doubts about the effectiveness of deletion that were raised by the hackers. The site says that untrue and deletion is effective.
“Contrary to current media reports, and based on accusations posted online by a cyber criminal, the ‘paid-delete’ option offered by AshleyMadison.com does in fact remove all information related to a member’s profile and communications activity,” the company said in a statement. “Contrary to current media reports, and based on accusations posted online by a cyber-criminal, the ‘paid delete’ option offered by AshleyMadison.com does in fact remove all information related to a member’s profile and communications activity,” the company said in a statement. “The process involves a hard delete of a requesting user’s profile, including the removal of posted pictures and all messages sent to other system users’ email boxes.”
“The process involves a hard-delete of a requesting user’s profile, including the removal of posted pictures and all messages sent to other system users’ email boxes.” But some experts say they still have doubts about what deletion actually means. “Sure, users’ data may have been ‘deleted’, but was it destroyed? Clearly not,” said Pat Clawson, chief executive of the Blancco Technology Group, which specialises in data destruction. “The two are not the same, and mistaking one for the other can put companies, their employees and their customers into serious trouble.”
But some experts say they still have doubts about what deletion actually means. “Sure, users’ data may have been ‘deleted’ but was it destroyed? Clearly not,” said Pat Clawson, chief executive of the Blancco Technology Group, which specialises in data destruction. “The two are not the same and mistaking one for the other can put companies, their employees and their customers into serious trouble.”
Deleting anything from Ashley Madison’s own servers may be too little, too late, if the hackers already have a copy of all the information stored elsewhere.Deleting anything from Ashley Madison’s own servers may be too little, too late, if the hackers already have a copy of all the information stored elsewhere.
Dudley Kneller, a partner specialising in technology and intellectual property at the Melbourne-based lawyers Madgwicks, advised users to change their passwords and bank pin numbers “to avoid ‘opportunistic’ risks to their information once the information becomes public”.Dudley Kneller, a partner specialising in technology and intellectual property at the Melbourne-based lawyers Madgwicks, advised users to change their passwords and bank pin numbers “to avoid ‘opportunistic’ risks to their information once the information becomes public”.
Will I be blackmailed if the hackers have my information?Will I be blackmailed if the hackers have my information?
It’s certainly possible. Will Gragido, head of threat research at cyber-intelligence company Digital Shadows, said it was likely that the hack was motivated by a desire to extort individuals.It’s certainly possible. Will Gragido, head of threat research at cyber-intelligence company Digital Shadows, said it was likely that the hack was motivated by a desire to extort individuals.
“The Ashley Madison breach seems typical of today’s more extortion and ransom-focused attacks,” he said. “Certain types of data and online behaviour are simply too attractive for blackmail purposes, and adversaries know the power of psychology and emotions when making demands like this.” “The Ashley Madison breach seems typical of today’s more extortion- and ransom-focused attacks,” he said. “Certain types of data and online behaviour are simply too attractive for blackmail purposes, and adversaries know the power of psychology and emotions when making demands like this.”
He pointed to the “comparatively little Ashley Madison data in circulation” compared with a similar attack on another hookup site, Adult Friend Finder. “The attackers want to hold as much as they can for ransom,” he said.He pointed to the “comparatively little Ashley Madison data in circulation” compared with a similar attack on another hookup site, Adult Friend Finder. “The attackers want to hold as much as they can for ransom,” he said.
Can I sue Ashley Madison?Can I sue Ashley Madison?
British users of the site may be able to bring a claim in the UK, even though the site is based in Canada, if it could be proved the site was processing personal data or conducting commercial activity in the country, such as selling advertisements - this is what happened with Google in Spain, which led to the “right to be forgotten” being established under EU data-protection laws.British users of the site may be able to bring a claim in the UK, even though the site is based in Canada, if it could be proved the site was processing personal data or conducting commercial activity in the country, such as selling advertisements - this is what happened with Google in Spain, which led to the “right to be forgotten” being established under EU data-protection laws.
Ashley Madison could potentially be found to be in breach of its obligations under the Data Protection Act 1998, and it could also be found to be in breach of contract if customers have paid for a deletion service but their details remain available. The Data Protection Act says a company must take “appropriate” measures to stop breaches of its personal data.Ashley Madison could potentially be found to be in breach of its obligations under the Data Protection Act 1998, and it could also be found to be in breach of contract if customers have paid for a deletion service but their details remain available. The Data Protection Act says a company must take “appropriate” measures to stop breaches of its personal data.
The barrister Felicity McMahon, a media and entertainment specialist at 5RB chambers, told the Guardian: “Much will depend upon whether they did take appropriate measures, something we just don’t know yet. Damages may be claimed where someone has suffered a financial loss or for distress – or both.” Felicity McMahon, a barrister specialising in media and entertainment at 5RB chambers, told the Guardian: “Much will depend upon whether they did take appropriate measures, something we just don’t know yet. Damages may be claimed where someone has suffered a financial loss or for distress – or both.”
Distress was likely to be exacerbated because of the sensitivity of the data, McMahon said. “It might be a breach of data protection if the hackers released information saying ‘Mr Jones is an accountant’ but it would not cause distress. It is very different if they release information saying ‘Mr Jones is having an affair’ and they have pictures of him in a state of undress. Distress was likely to be exacerbated because of the sensitivity of the data, McMahon said. “It might be a breach of data protection if the hackers released information saying, ‘Mr Jones is an accountant’, but it would not cause distress. It is very different if they release information saying ‘Mr Jones is having an affair’ and they have pictures of him in a state of undress. And that may also potentially lead to financial loss, if the information results in divorce, for example.”
“And that may also potentially lead to financial loss, if the information results in divorce, for example.”
McMahon said that those who wished to sue the company would have to apply for a court order in order to remain anonymous. “This is frequently done in actions for misuse of private information, where putting the name of the claimant into the public domain would defeat the object of the action,” she added.McMahon said that those who wished to sue the company would have to apply for a court order in order to remain anonymous. “This is frequently done in actions for misuse of private information, where putting the name of the claimant into the public domain would defeat the object of the action,” she added.