Ashley Madison, 2015: when the data itself was the weapon

Every other case file here is about data being stolen for money. Ashley Madison is the one where the data was taken in order to be published, by people who wanted the exposure itself to be the punishment, and it is the clearest demonstration that the harm from a breach is not always fraud. Sometimes it is simply that someone now knows.

What happened

On 19 July 2015, visitors to Ashley Madison, a dating service built explicitly around extramarital affairs, owned by Toronto-based Avid Life Media, were shown a message from a group calling itself The Impact Team. It claimed to have the company's full customer database and demanded that Ashley Madison and a sister site, Established Men, be taken offline permanently. This was not a ransom in the usual sense: there was no price. The demand was that the business cease to exist.

Avid Life Media did not comply. On 18 and 20 August, the attackers published, in two releases: roughly 32 million user records, internal company documents, source code, and the chief executive's email archive. It was posted openly and mirrored instantly. Within days, searchable web front-ends existed for anyone to check a name or an email address.

The password story

Ashley Madison did something most breached companies of that era did not: it stored passwords with bcrypt at a high cost factor. That is real, correct password hashing, slow by design, salted per user, resistant to large-scale cracking. For a few weeks after the dump, the passwords held.

The parts that were not technical

Two findings from the joint Canadian and Australian privacy investigation stand out, because neither is about hackers.

The paid deletion that did not delete. Ashley Madison sold a "full delete" option: pay a fee, and your profile and data are removed. Regulators found the deletion was incomplete, the company retained information, including payment records, after taking money to erase it. Selling a privacy promise you do not keep converts a security incident into a deception case.

The fabricated trust mark. The site displayed a security award icon that no one had awarded it. Investigators found it had been created in-house. It is a small detail that tells you a great deal about how seriously the underlying controls were taken.

And one more, which changes how the leaked list should be read: the service never verified email addresses at registration. Anyone could sign up with anyone's address. This is why the widely reported presence of government and military addresses in the file proved so little, and why treating the dump as a list of confirmed users was wrong from the first day.

The human cost

This is the part that separates Ashley Madison from every other entry in this archive. Within days of publication, extortion emails began arriving at addresses in the file, pay, or your spouse, employer and contacts get told. Some of the recipients had never used the service. It did not matter, because the accusation was the weapon.

In Canada, police investigating the case reported suicides connected to the leak. A police captain in San Antonio took his own life days after the data appeared. Divorces, resignations and family breakdowns followed through the rest of the year, and in countries where same-sex relationships or adultery are criminalised, the exposure carried legal danger rather than social embarrassment.

No fraud occurred in any of that. Nobody's money was stolen. The damage was done entirely by the fact of publication.

The timeline

1. 19 July 2015: The Impact Team announces the breach and demands the site be shut down.
2. 18 and 20 August: Around 32 million user records, internal documents and the CEO's emails are published.
3. Late August: Extortion emails begin; searchable lookup sites appear; the first reported suicides.
4. 28 August: Chief executive Noel Biderman leaves the company.
5. September 2015: Researchers recover roughly 11 million passwords through the legacy MD5 token.
6. August 2016: Canadian and Australian privacy commissioners publish joint findings: inadequate security framework, retained data after paid deletion, a fabricated security trust mark.
7. December 2016: FTC and 13 states settle for $1.6 million against a suspended $17.5 million judgment.
8. 2017: An $11.2 million class-action settlement is approved in the United States.

What it changed

Sensitivity entered the risk calculation properly. Before Ashley Madison, breach severity was largely measured in identity-theft terms: how many card numbers, how many national identifiers. This case forced a second axis, what does this data imply about a person, and what happens to them if it is published? That axis now drives how health data, sexual-orientation data and location history are classified, and it is why the breach archive weights those fields the way it does.

Deletion became auditable. "Delete my account" stopped being a UI affordance and became a claim regulators will test. The right to erasure written into the GDPR two years later has a very similar shape to the finding against Avid Life Media.

Unverified email addresses became a liability. Letting anyone register any address seemed harmless while the database was private. In a published dump it implicated people who had never visited the site, and there was no way to un-ring that bell.

If you were in it, or accused of being in it