Ashley Madison: Two women explain how hack changed their lives

Posted on August 28, 2015

When infidelity dating site Ashley Madison was hacked, the details of 33 million user accounts were published on the web.

The BBC has spoken to two women, one whose fiance used the site and one who used it herself.

Neither wanted to be identified, but their stories give some hint of just how dramatic and wide-reaching the impact of the hack has been.

The first only wanted to be named as “Maria”. She says she used an online tool to search for her fiance’s email address in the dumped data.

“I really didn’t think I would find anything on anybody,” she comments.

She wanted to check, though, because one of her own email accounts had been compromised recently.

When she entered her fiance’s address as well, the database not only confirmed it was there but it spat back a postcode, city and birthdate. All were accurate.

“These things logged your IP [Internet Protocol] address, they logged your provider, they logged everything and not only that, it was your physical description,” she explained to the BBC. “It matched his to a T.”

Maria quickly confronted her fiance.

‘Multiple affairs’

“He denied and denied and denied at first and then he acquiesced and confessed what he did.

“Yes, (he said) he did have multiple affairs, yes. It just… it came out,” she says.

Her fiance said that he couldn’t explain fully why he did what he did and that Maria meant more to him than the women he had met on Ashley Madison. But the conversation didn’t last long.

Maria packed a week’s worth of clothes and left to stay with a friend. The wedding they had been planning is cancelled.

She has since booked a sexual health check, she says, and tried to distance herself as much as possible from her fiance. The whole experience has been “shattering”, she adds.

“It’s one thing if you come forward and say I’m not satisfied or I’m not happy or I’m finding it hard to remain faithful – as long as you’re open,” she says.

“It’s just completely unfair to waste years of a person’s life with duplicity.”

Online advice

You don’t have to look far online to find examples of internet users who seem to be personally affected by the hacking of Ashley Madison. Various forums are full of threads from those who believe their “SO” (significant other) was on the site.

But users of the dating site are also turning to the web for help.

One woman who used Ashley Madison, but who did not want to be named, has also spoken to the BBC. For the purposes of this article, we will refer to her as “Amy”.

She has been married to her husband for 10 years.

But recently she became interested in the idea of having an affair. She had heard advertisements for Ashley Madison on local radio, so a year ago she signed up and began looking for a man with whom to have a relationship.

However, she says she never messaged anyone and soon closed down the account. But six months ago she created another and this time she wanted to address questions she had about her sexuality by contacting other women.

This time she did find someone to talk to. They emailed one another, she says, for several weeks.

“She was close to where I live and we seemed to hit it off,” says Amy.

“Her story seemed so much similar to mine. She was someone who had been married for a while [and] she had always been curious about that side of herself.”

Amy says the woman she corresponded with told her she thought she was attractive, which made Amy feel flattered.

They were due to to meet, but at the last moment Amy called it off. She says she became fearful and began to feel that her marriage was something she didn’t want to jeopardise.

“Using it kind of made me realise that there were other things that I need to look at,” she explains.

“It’s scary when you have this person that you love so much and you think about hurting them.”

Married and curious

Amy says that so far she hasn’t told anyone who knows her about what happened, but she’s now worried that her husband might find out that she used the site.

She has distracted herself with work for now, but comments that she feels stressed and that the episode has affected her sleep.

Ashley Madison offered users a $19 (£12) “Full Delete” service, which Amy says she used. She checked an online tool to search for her email address in the leaked database and was surprised to find it there, along with other information such as her postcode, gender and the name associated with her credit card.

It’s not clear what has happened in this case, but it’s possible that the database was downloaded by hackers before the date on which Amy paid for her information to be removed.

Either way, she thinks there is now a possibility she’ll be found out.

“If my husband were to come home from work today and say someone found my information I would be open and honest with him about it,” she says.

“It’s really made me think about my behaviour and why I did what I did – and to cherish what I have.”

For now, though, Amy just hopes her husband won’t find out.

Source:http://www.bbc.com/

Court Says the FTC Can Slap Companies for Getting Hacked

Posted on August 25, 2015

FOR COMPANIES LIKE the dating site Ashley Madison or the health insurer Anthem, financial loss, customer anger and professional embarrassment aren’t the only consequences of getting massively gutted by hackers. Now a court has confirmed that there’s a three-letter agency that can dish out punishment, too.

In a decision published Monday, a U.S. appellate court ruled that the Federal Trade Commission has the authority to sue Wyndham Hotels for allowing hackers to steal more than 600,000 customers’ data from its computer systems in 2008 and 2009, leading to more than $10 million in fraudulent charges. The ruling more widely cements the agency’s power to regulate and fine firms that lose consumer data to hackers, if the companies engaged in what the FTC deems “unfair” or “deceptive” business practices. At a time when ever-more-private data is constantly getting breached, the decision affirms the FTC’s role as a digital watchdog with actual teeth.

‘This Is a Major Deal’

The FTC originally sued Wyndham in 2012 over the lack of security that led to its massive hack. But before the case proceeded, Wyndham appealed to a higher court to dismiss it, arguing that the FTC didn’t have the authority to punish the hotel chain for its breach. The third circuit court’s new decision spells out that Wyndham’s breach is exactly the sort of “unfair or deceptive business practice” the FTC is empowered to stop, sending Wyndham back to face the FTC’s lawsuit in a lower court.

“A company does not act equitably when it publishes a privacy policy to attract customers who are concerned about data privacy, fails to make good on that promise by investing inadequate resources in cybersecurity, exposes its unsuspecting customers to substantial financial injury, and retains the profits of their business,” reads the court’s ruling.

For consumer privacy watchdogs, the ruling comes as a relief, solidifying another serious legal incentive for companies to invest in protecting their customers’ data, according to Electronic Privacy Information Center attorney Alan Butler. “This a huge victory for the FTC, but also for American consumers,” says Butler, who filed an amicus brief defending the FTC’s authority earlier in the case. “We see services and companies being hacked on an almost daily basis now. Having the FTC out there, bringing actions against companies that fail to protect consumers’ data is a critical tool.”

Wyndham Hotels, for its part, vowed to continue its case in the lower court. The company points out that the appellate court ruled on the FTC’s authority, not the specific allegations the agency made against Wyndham, namely that it had failed to adequately protect its customers. “We believe the facts will show the FTC’s allegations are unfounded,” reads a statement from Wyndham spokesperson Michael Valentino. “Safeguarding personal information remains a top priority for our company, and with the dramatic increase in the number and severity of cyberattacks on both public and private institutions, we believe consumers will be best served by the government and businesses working together collaboratively rather than as adversaries.”

Even if Wyndham does eventually lose its case against the FTC, it likely won’t be fined, says Berkeley Law professor Chris Hofnagle. Instead, it could face the kind of privacy probation that is a frequent outcome of the FTC’s privacy suits against firms, in which the agency closely oversees its data protection systems for a period as long as 20 years, with the option to later impose fines for any violation of the standards it imposes.

But aside from Wyndham itself, the appellate ruling establishes a more important precedent for the legal consequences of a data breach. “Had Wyndham won at the third circuit, it would have called into question the FTC’s ability to police privacy and security,” says Hofnagle, describing that avoided outcome as a “disaster” for the agency. “This is a major deal.”

Data Insecurity As ‘Unfair’ Business Practice

In its original lawsuit, the FTC accused Wyndham of a long litany of privacy fails, from storing credit card information unencrypted to lacking firewalls to using easily-guessed passwords. The agency compared those practices to Wyndham’s published privacy policy—which promised that it did use some kinds of encryption to protect consumer data as well as firewalls and other “safeguards”—and argued that its insecurity amounted to “unfair” business practices.

Wyndham had specifically challenged that “unfair” claim, arguing that it hadn’t actually engaged in the “unscrupulous or unethical behavior” that it said the FTC’s standard requires. But the appellate court wasn’t persuaded; It ruled that the alleged mismatches between its data protection and its privacy policy were sufficient to meet that “unfair” standard, without any accusations of “unethical” behavior necessary.

The Court also rejected another argument from Wyndham that if the FTC were allowed to punish companies for this sort of data breach, it would be allowed to sue any supermarket that’s “sloppy about sweeping up banana peels,” opening the door to unfair practice claims run amok. On that point, the Court snapped back: “Were Wyndham a supermarket, leaving so many banana peels all over the place that 619,000 customers fall hardly suggests it should be immune from liability.”

The appellate ruling doesn’t necessarily grant the FTC new powers so much as dispel legal questions around the power it already possesses to be a data security watchdog, says Berkeley’s Hofnagle. As data breaches increasingly become a source of real suffering for consumers—see the reports of suicides that have already resulted from Ashley Madison’s scandalous data spill—the agency’s mandate more important than ever.

“The law has always imposed responsibility on companies for the care of their customers. When you’re in the restaurant you have to be protected against slips and falls or food-borne illness,” says Hofnagle. “Data is just something new that companies have to protect if they want to bear the benefits of collecting it.”

Source:http://www.wired.com/