Ashley Madison (Avid Life Media) breach

In July 2015, a group calling itself the Impact Team announced it had breached Ashley Madison, the Toronto-based dating site that marketed extramarital affairs under the slogan "Life is short. Have an affair." The attackers demanded that parent company Avid Life Media permanently shut down Ashley Madison and a sister site, Established Men, or they would publish the site's entire customer database. The company refused — and the attackers followed through.

What happened

The Impact Team obtained access to Avid Life Media's systems and exfiltrated the company's account database along with internal corporate records. On 15 July 2015 they issued their ultimatum; by 19 July the breach was public, and CEO Noel Biderman characterised it as a criminal act. When the company declined to close the sites, the attackers escalated.

On 18 August 2015 the Impact Team published more than 60 GB of data via BitTorrent, covering roughly 32 million accounts. A second dump on 20 August released internal corporate emails, including the CEO's correspondence.

What was exposed

The leaked data included:

• Real names, email addresses, and home addresses provided at sign-up
• Sexual preferences and account activity
• Partial credit-card and payment-transaction records

The dump exposed a particularly damaging fact: Ashley Madison's paid "full delete" service, which charged users to erase their profiles, had not actually removed their data — directly contradicting the company's marketing.

Impact

The fallout was severe and personal. The exposure of named users triggered widespread extortion campaigns demanding Bitcoin payments, and was linked to reports of suicides. CEO Noel Biderman resigned on 28 August 2015.

Regulators acted on the underlying security and marketing failures. In December 2016, the U.S. FTC and 13 states plus the District of Columbia settled with the company (by then renamed Ruby Corp), which agreed to a $17.5 million judgment, largely suspended, paying $1.6 million. The FTC alleged both lax data-security practices and the use of fake "engager" profiles to lure users. In 2017, Ruby Corp agreed to an additional $11.2 million settlement of consumer class-action claims.

Why it matters

The Ashley Madison breach reshaped thinking about the real-world harm of data exposure. Unlike payment-card breaches, where the damage is largely financial and reversible, this leak exposed intimate personal information that could not be undone — fuelling extortion, reputational ruin, and tragedy. It also became a landmark data-deletion and truth-in-marketing case: charging users to erase data the company quietly retained drew direct regulatory action and foreshadowed later "right to erasure" requirements under regimes such as the GDPR.