The massive leak attributed to the hackers who rooted to the Ashley Madison dating website for cheaters has been confirmed to be genuine. As if that wasn’t bad enough, the 10 gigabytes of data—compressed, no less—is far more wide-ranging than almost anyone could have imagined.
Researchers are still poring over the unusually large dump, but already they say it includes user names, first and last names, and hashed passwords for 33 million accounts, partial credit card data, street names, and phone numbers for huge numbers of users, records documenting 9.6 million transactions, and 36 million e-mail addresses. While much of the data is sure to correspond to anonymous burner accounts, it’s a likely bet many of them belong to real people who visited the site for clandestine encounters. For what it’s worth, more than 15,000 of the e-mail addresses are hosted by US government and military servers using the .gov and .mil top-level domains.
The leak also includes PayPal accounts used by Ashley Madison executives, Windows domain credentials for employees, and a large number of proprietary internal documents. Also found: huge numbers of internal documents, memos, org charts, contracts, sales techniques, and more.
“The biggest indicators to legitimacy comes from these internal documents, much containing sensitive internal data relating to the server infrastructure, org charts, and more,” TrustedSec researcher Dave Kennedy wrote in a blog post. “This is much more problematic as it’s not just a database dump, this is a full scale compromise of the entire companies [sic] infrastructure including Windows domain and more.”
Kennedy continued:
So far, it looks like around 33 million usernames, first names, last names, street addresses, and more are impacted by this breach.
The dump itself – 10 gigs COMPRESSED. For folks that may not know, that is massive. Huge.
Regardless of ethics, this is a massive data breach where attackers had full and maintained access to a large percentage of Ashley Madison’s organization undetected for a long period of time. Ashley Madison has not commented on the original source of the breach, how it occurred, or how they were compromised.
This dump appears to be legit. Very, very legit.
Kennedy, who additionally said four Ashley Madison subscribers told him they found their data in the leak, isn’t the only one to confirm its authenticity. Both Errata Security CEO Rob Graham and security journalist Brian Krebs have reported Ashley Madison subscribers telling them the last four digits of their credit cards were included in the files. Much of the data includes subscribers’ sexual predilections, such as “Threesome,” “Being Dominant/Master,” “Being Submissive/Slave,” and “Bondage.” Relationship statuses include “attached female seeking male,” “attached male seeking female,” “single male seeking female,” “single female seeking male,” “male seeking male,” and “female seeking female.”
-arstechnica