Ashley Madison client-data dumped onto DarkWeb - verified
Hackers have made good their threat to expose the user data of the Ashley Madison "cheating" sites, should those sites not be closed down by the company.  Yesterday the data of 37m users was dumped on-line, including names, addresses, emails, and transaction history. However the data is not easily accessible given that the 9.7G of data is only accessible via the DarkWeb. This is possibly the worst outcome for Ashley Madison clients as they will now be open to all kinds of criminal targeting, ranging from simple fraud through to ransome attacks. Brian Krebs of KrebsonSecurity has now had the quality of the leaked data verified by three different sources.
Hackers who stole sensitive customer information from the cheating site AshleyMadison.com appear to have made good on their threat to post the data online.

A data dump, 9.7 gigabytes in size, was posted on Tuesday to the dark web using an Onion address accessible only through the Tor browser. The files appear to include account details and log-ins for some 32 million users of the social networking site, touted as the premier site for married individuals seeking partners for affairs. Seven years worth of credit card and other payment transaction details are also part of the dump. AshleyMadison.com claimed to have nearly 40 million users at the time of the breach about a month ago, all apparently in the market for clandestine hookups.

"Ashley Madison is the most famous name in infidelity and married dating," the site asserts on its homepage. "Have an Affair today on Ashley Madison. Thousands of cheating wives and cheating husbands signup everyday looking for an affair.... With Our affair guarantee package we guarantee you will find the perfect affair partner."

The data released by the hackers includes names, passwords, addresses and phone numbers submitted by users of the site, though it's unclear how many members provided legitimate details to open accounts. A sampling of the leaked data indicates that users provided random numbers and addresses to open accounts. But files containing credit card transactions likely yield real names and addresses, unless members of the site used anonymous pre-paid cards, which offer more anonymity. This data, which amounts to millions of payment transactions going back to 2008, includes names, street address, email address and amount paid, but not the full credit card numbers; instead it includes just four digits for each transaction, which may in fact be the last four digits of the credit card numbers or simply a transaction ID unique to each charge.

One analysis of email addresses found in the data dump also shows that some 15,000 are .mil. or .gov addresses. It's not clear, however, how many of these are legitimate addresses.

The data also includes descriptions of what members were seeking. "I'm looking for someone who isn't happy at home or just bored and looking for some excitement," wrote one member who provided an address in Ottawa and the name and phone number of someone who works for the Customs and Immigration Union in Canada. "I love it when I'm called and told I have 15 minutes to get to someplace where I'll be greeted at the door with a surprise—maybe lingerie, nakedness. I like to ravish and be ravished ... I like lots of foreplay and stamina, fun, discretion, oral, even willingness to experiment—*smile*"

Passwords released in the data dump appear to have been hashed using the bcrypt algorithm for PHP, but Robert Graham, CEO of Erratasec, says that despite this being one of the most secure ways to store passwords, "hackers are still likely to be able to 'crack' many of these hashes in order to discover the account holder's original password." If the accounts are still online, this means hackers will be able to grab any private correspondence associated with the accounts.