10 An Imperfect Affair: Ashley Madison and the Economics of Embarrassment

The Sony Pictures breach provided a window into the private correspondence and behind-the-scenes gossip of Hollywood celebrities, but the 2015 breach of the website Ashley Madison, a dating site aimed at people interested in pursuing extramarital affairs, offered something that was arguably even more tantalizing: a chance to gawk at the private lives of neighbors and co-workers. In the summer of 2015, a group calling itself the “Impact Team” published information stolen from Ashley Madison's Toronto-based parent company, Avid Life Media (ALM), including the names, photos, profile information, email addresses, credit card numbers, and billing addresses of many of the site's 37 million users. As with the Spamhaus and Sony Pictures incidents, the perpetrators of the ALM breach made no attempt to hide the fact that they were out to publicly shame the company, in this case apparently because of its poor security. In a long manifesto published alongside the stolen data, the Impact Team claimed that the breach had been motivated largely by ALM's misrepresentation of its own data security practices. In particular, the Impact Team called out the “full delete” option offered to Ashley Madison customers to erase their information from the site for a fee of $19 as a “complete lie,” writing: “Users almost always pay with credit card; their purchase details are not removed as promised, and include real name and address, which is of course the most important information the users want removed.”
1