In July 2015, the hacker group calling itself The Impact Team breached Ashley Madison and threatened to publish its users’ identities unless Avid Life Media shut down the site and Established Men. More than 2,500 records were released on July 21, followed by over 60 gigabytes of data on August 18 and 20, including names, addresses, search histories, payment records, corporate emails, and information from customers who had paid for supposedly complete profile deletion. The company initially disputed that its main database was insecure, although CEO Noel Biderman acknowledged the criminal intrusion and said the company was cooperating with law enforcement.
The disclosure also exposed serious platform and business-practice failures. Ashley Madison did not require email verification, charged users to delete profiles, and represented that deletion was complete even though the breach showed retained data. Subsequent analysis reported that Avid Life Media had created more than 70,000 female-imitating bots to send messages to male users; a separate password-design flaw involving MD5 enabled roughly 11 million passwords to be cracked. In July 2017, renamed Ruby Corporation agreed to pay $11.2 million to settle approximately two dozen lawsuits arising from the breach. The company later added two-factor verification, encrypted browsing, and PCI compliance, while the leak triggered extortion attempts, public shaming, and continuing debates over privacy and media ethics.
