One month after infiltrating cheating site Ashley Madison, a group of hackers reportedly posted the stolen customer information online.
The massive data dump—33 million accounts and 36 million email addresses—was posted Tuesday on the dark Web. The Hydraze blog said the leaked files—which include names, street and email addresses, phone numbers, and credit card transactions—"seem totally legit," something echoed by security reporter Brian Krebs.
I'm sure there are millions of AshleyMadison users who wish it weren't so, but there is every indication this dump is the real deal.
— briankrebs (@briankrebs) August 19, 2015
In a Tuesday statement, Ashley Madison owner Avid Life Media (ALM) said it is actively monitoring and investigating the leak "to determine the validity of any information posted online."
To peruse the data, you'll need the Tor browser, which allows for secure and anonymous Web surfing by bouncing your communications around a distributed network of relays. It's often used by people living in countries with repressive regimes, but is also a favorite of scammers and hackers who want to avoid capture. (UPDATE: You can now search emails via ashley.cynic.al.)
Last month, the hackers, who call themselves The Impact Team, threatened to release the full data unless Ashley Madison and its sister sites—Cougar Life and Established Men—were shut down.
"Avid Life Media has failed to take down Ashley Madison and Established Men," the hackers said yesterday, as reported by Hydraze. "We have explained the fraud, deceit, and stupidity of ALM and their members. Now everyone gets to see their data."
The hackers claim that the "scam site" features thousands of fake female profiles, and that almost 95 percent of actual users are male. "Chances are your man signed up on the world's biggest affair site, but never had one," the hackers said. "He just tried to. If that distinction matters."
Meanwhile, a $19 service that allows members to expunge their online profiles is a scam, according to the hackers. Contrary to what the site advertises, the "full delete" feature doesn't actually remove usage history or personal information like real names and addresses, the hackers alleged.
ALM is still working with local and international law enforcement to identify the hackers and "hold the guilty parties accountable to the strictest measures of the law."
"This event is not an act of hacktivism, it is an act of criminality. It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities," the company said.
"The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror, and executioner, seeing fit to impose a personal notion of virtue on all of society," ALM continued. "We will not sit idly by and allow these thieves to force their personal ideology on citizens around the world."
In May, a hacker leaked data from 3.9 million AdultFriendFinder members onto a darknet forum. The dump included birthdays, ZIP codes, IP addresses, sexual orientations, and whether or not the user was interested in an extramarital affair. Even AdultFriendFinder users who previously deleted their accounts found their privacy compromised—a likely issue with the Ashley Madison breach, as well.
For more, see Ashley Madison: Hacking Hits Home and How to Create a Burner Account on Ashley Madison (And Other Sketchy Sites).