Extramarital dating site Ashley Madison has apologised to its users a second time for allowing its database to be comprehensively stolen, and is temporarily offering users the ability to fully delete their account from the site free of charge.
The “paid delete” ability, which typically costs £15 in the UK and $19 in the US per account, was cited by Ashley Madison’s pseudonymous attacker, The Impact Team, as a main reason for the hack in the first place. The group alleged that the site did not in fact fully delete all information about a user, even after they had paid the fee.
In a statement, Ashley Madison said that that claim was false. “Contrary to current media reports, and based on accusations posted online by a cyber criminal, the “paid-delete” option offered by AshleyMadison.com does in fact remove all information related to a member’s profile and communications activity.
“The process involves a hard-delete of a requesting user’s profile, including the removal of posted pictures and all messages sent to other system users’ email boxes. This option was developed due to specific member requests for just such a service, and designed based on their feedback.”
Although the stolen information is already in the hands of The Impact Team, the site is now offering users the ability to delete accounts free of charge. “As our customers’ privacy is of the utmost concern to us, we are now offering our full-delete option free to any member, in light of today’s news,” the statement says.
It is not clear whether the move is intended to assuage some of the hackers demands or simply an attempt to lock the stable door after the horse has bolted.
The company, which described the hack as an “act of cyber-terrorism”, has been attempting to keep the preliminary data dump from the hackers off the web, and claims success in the matter. “Using the Digital Millennium Copyright Act (DMCA), our team has now successfully removed the posts related to this incident as well as all Personally Identifiable Information (PII) about our users published online.” As a result, the six initial locations the attackers posted the information in are now clear. But with the data now in the wild, and the attackers promising to release more, firefighting is likely to be a doomed effort in the long run.
Tod Beardsley, security engineering manager at cybersecurity firm Rapid7, says the hack is likely to be extremely damaging once more data is made public, as users will not want to admit they have suffered a breach.
“Dating sites also host millions of intensely private scraps of user data,” Beardsley said. “Users of these services may routinely share risqué photos, checklists of sexual preferences, and patterns of romantic activity that they consider deeply personal. Because of this, any breach involving a dating site comes with a built-in ‘ickiness’ factor.
“Dating site users are likely to feel more violated after a breach than those caught up in a retail or government website breach, and they are less likely to reach out for help and advice on how to manage their identity information after a breach. For Ashley Madison users in particular, this tendency to suffer silently is all but guaranteed.”
Ashley Madison’s chief executive and founder, Noel Biderman, said on Sundaythat the firm believes the hack was an inside job, from someone who already had access to its systems. “I’ve got their profile right in front of me, all their work credentials,” he told the security journalist Brian Krebs. “It was definitely a person here that was not an employee but certainly had touched our technical services.”
Source: https://www.theguardian.com
