Ashley Madison Breach Exposes Over 30 Million User Records
What Happened – In July 2015 attackers compromised the Ashley Madison infidelity‑website database and publicly released the contents. The dump contained personal data for 30,811,934 accounts, including names, email addresses, passwords, payment histories, dates of birth, ethnicities, genders, sexual orientations, phone numbers, physical addresses, security‑question answers and website activity.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient data‑protection controls (encryption at rest, tokenisation, strict access segregation).
- Highlights the need for continuous monitoring and auditable evidence that privacy‑related controls are operating as intended.
- Underscores the importance of a documented incident‑response plan that can produce a defensible audit trail after a large‑scale data exposure.
Who Is Affected – Consumer‑facing SaaS platforms that store sensitive personal information (online dating, social networking, subscription services).
Recommended Actions
- Verify that all personally identifiable information (PII) is encrypted both in transit and at rest, and that encryption keys are tightly managed.
- Review and harden access‑control policies; enforce least‑privilege and multi‑factor authentication for privileged accounts.
- Update incident‑response playbooks to include rapid forensic collection, breach notification workflows, and evidence‑preservation procedures.
Technical Notes – The public disclosure did not attribute a specific vulnerability; the attack vector remains unknown. Exfiltrated data types span demographic, financial and authentication credentials, making the breach “sensitive” under most privacy regulations. Source: Have I Been Pwned – Ashley Madison breach