It’s become as routine as the robbery of the corner liquor store.
Name-brand companies, trusted by millions, hit with massive data breaches that compromise their customers’ and/or employees’ most sensitive financial and personal information.
Among those companies:
- Home Depot
- Dairy Queen
- Anthem, Inc.
- Sony Pictures
- Primera Blue Cross
- U.S. Postal Service
And as of July 15, Ashley Madison joined this list.
Ashley Madison is, of course, the notorious website for cheating wives and husbands.
Launched in 2001, its catchy slogan is: “Life is short. Have an affair.”
One of its ads featured a photo of a woman apparently kneeling at the feet of a bare-chested man, her hand passionately clawing at his belt. Next to her was the caption: “Join FREE & change your life today. Guaranteed!”
Ashley Madison claims to have more than 37 million members.
Calling themselves “The Impact Team,” hackers appear to be enraged at the company’s “full delete” service, which promises to completely erase a user’s profile and all associated data for a $19 fee.
“Full Delete netted [Avid Life Media, the parent company of Ashley Madison] $1.7 million in revenue in 2014,” the hackers were quoted as saying in an online manifesto. “It’s also a complete lie.
“Users almost always pay with credit card; their purchase details are not removed as promised, and include real names and address, which is of course the most important information the users want removed.”
On July 20, Avid Life Media defended the service, and said it would make it free.
The hackers demanded: “AM [Ashley Madison] AND EM [Established Men] MUST SHUT DOWN IMMEDIATELY PERMANENTLY.
“We have taken over all systems in your entire office and production domains, all customer information databases, source code repositories, financial records, emails.
“Shutting down AM and EM will cost you, but non-compliance will cost you more.”
The hackers threatened to “release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails.”
Interestingly, the hackers did not target the company’s “CougarLife” website, which caters to female members seeking “a young stud.”
Avid Life Media assured its customers that it had hired “one of the world’s top IT security teams” to work on the breach:
“At this time, we have been able to secure our sites, and close the unauthorized access points. We are working with law enforcement agencies, which are investigating this criminal act.”
This statement gives new meaning to the phrase, “Closing the barn door after the cow has gotten out.”
It’s almost comical, except for the fact that the marriages of millions of people are likely to be threatened by the release of such information.
And it raises the question: Why wasn’t this “top IT security team” hired at the outset?
A website offering cheating services to those wealthy enough to afford high-priced fees is an obvious target for hackers. After all, its database is a blackmailer’s dream-come-true.
This latest breach comes about two months after a similar dating site, Adult FriendFinder–with an estimated 64 million members–was hit with a similar attack.
Again, it was clear that a site like this would be a prime target for those seeking information for blackmail. Yet apparently its owners didn’t care enough about the privacy of their customers to provide adequate security.
“Without question, this is incredibly valuable information,” said J.J. Thompson, founder and chief executive of Rook Security, an IT security firm.
“[Ashley Madison’s customers] are now vulnerable to a significant secret.”
As usual when a corporation’s data breach occurs, Ashley Madison issued a reassuring statement: “We are working with law enforcement agencies, which are investigating this criminal act.
“Any and all parties responsible for this act of cyber-terrorism will be held responsible.”
Brave-sounding words. But if the hackers make good on their threat, many prominent men in business and politics may soon find themselves facing expensive divorces.
And if that happens, at least some of them may well decide to take out their anger and embarrassment on the websits that assured them that the highly private information they shared was “100% secure.”
That could set a precedent for lawsuits by other victims of such data breaches. Which, in turn, could force profit-obsessed corporations to responsibly protect the highly sensitive information entrusted to them.
There is an important lesson to be learned from this latest disaster.
“Stuff that’s online is pretty much not private, no matter what you might hope or think or wish for,” said Geoff Webb, senior director of solution strategy for security management firm NetIQ.
Old records, like transactions and account details, remain in company databases long after you’ve deleted an account, he said, because the company needs them for tax and other business purposes.
“There used to be an old saying that everybody ends up naked on the Internet at some point,” said Webb.
Although that was meant figuratively, patrons of websites like Ashley Madison could soon find it applying literally.