Hackers calling themselves the Impact Team have released about 9.6Gb of data containing what they claim to be all of the business data of cheating website AshleyMadison.com. The hackers have gained access to the files in July 2015 and tried to blackmail AshleyMadison’s parent company Avid Life Media (ALM). The Impact Team wanted ALM to cease all operations on AshleyMadison.com and its sister sites immediately and permanently. Should ALM not comply, the data would be made public. ALM did not comply.

What Data was Published?

Impact Team’s leak contains, among other data, the following:

• E-Mail addresses of all users
• Sexual preferences of all users
• Credit car transaction data
• Internal communication of ALM
• Details concerning technology ALM is using
• Private data of ALM employees

The data is unsorted and contained in SQL export files. They contain many duplicates. There are 30,612,512 unique e-mail addresses, 56,323 of which end in .ch.

Can the Data be Viewed?

Theoretically, yes. It is possible you can look at the data, but it is unlikely. The data is stored in cleartext, but the file with the e-mail addresses – arguably one of the smaller files – is 1.7GB in size. Every normal text editor is not made to handle files this size. The files need to be split before they can be read.

Who Was Cheated on?

Even if you’re able to read the data and see all the e-mail addresses without your computer crashing, it doesn’t mean that your partner cheated on you. Security researcher Per Thorsheim has told techblog Techcrunch that AshleyMadison does not verify mail addresses.

This makes it easy for people to create accounts using a fake e-mail address or a mail address that does not belong to them. Also, there are many clearly fake mail addresses such as aaa@bbb.com as well as obvious nicknames.

How Secure is Credit Card Data?

The files leaked by Impact Team contain 2643 files that contain transaction data from credit cards. They’re sorted by day and time of transaction. In these files, ALM has collected the following data:

• Account number
• Site the user is registered on (i.e. Ashley Madison)
• Amount transferred in unspecified currency
• Authorization code
• AVS
• Brand of credit card in abbreviated form
• Last four digits of credit card number
• CVD
• First name: Most often, this field is filled with numbers
• Last name: Most often, this field contains first and last name
• Merchant ID
• Option code
• Date and time of purchase in unknown time zone
• Transaction ID
• Confirmation number
• Error code
• Status of authorization
• Type of transaction (i.e. Purchase, Confirmation, Settlement)
• Place of residence of the client
• Country where the client lives
• E-Mail address of the client
• IP of the client
• Zip Code of the client’s place of residence

If your name shows up in one of these files, then it’s highly likely that you were doing business with ALM. With the data ALM has collected, it is not possible to make a purchase using your credit card.

About the Author

Dominik Bärlocher has been working with IT subjects since 2006. The journalist relied on his affinity for all things IT during his tenures at news papers and benefited from it. At scip, he conducts OSINT researches and is an expert at information gathering.

Links

• http://techcrunch.com/2015/08/19/ashley-madison-data-dumped/
• http://www.ashleymadison.com