Ashley Madison: "fake female profiles" adds to data security failures
As we reported yesterday, the Ashley Madison customer data dumped on the DarkWeb is genuine and the fallout has already begun with politicians and public servants amongst those finding themselves "named" in the press. In 2012 the parent company of Ashley Madison was sued by an ex-employee (Doriana Silva, Brazilian national) for repetitive stress injury: Ms Silva stated that in the run up to the company's Portuguese site she was instructed to create a thousand bogus female profiles in a three week period (see Lawsuit section, here). Ashley Madison counter-sued claiming, amongst other things, that Ms Silva "kept" confidential documents.  In January of this year the law case was finally dismissed; but now, six months later all client data has been published and Ashley Madison will likely be sued for not protecting user-profiles. The text-file message at the start of the data-dump specifically refers to "fake female profiles".
A married SNP MP whose email address was among the millions released in a data hack on adultery website Ashley Madison has said she is the victim of a smear campaign.

Michelle Thomson, the MP for Edinburgh West, said her identity was “harvested” by hackers who published what they claim to be the personal information, including names, email addresses, phone numbers and partial credit card numbers of the social network’s 37 million users.

“Along with potentially millions of others, an out-of-use email address seems to have been harvested by hackers,” Thomson said. “I am not aware of, or in contact with, either Avid Life or Ashley Madison and look forward to finding out more about what has actually happened.

“However, having a personal email address linked to an account doesn’t mean that person is really a user of Ashley Madison. Users are able to sign up to the site without responding to an email verification, meaning anyone’s email address could have been used to create an account.”

Hackers calling themselves Impact Team posted the 10 gigabyte file called “Time’s Up!” on BitTorrent and the dark web on Tuesday night, calling the users “cheating dirtbags” saying they “do not deserve anonymity”.

The Impact team stole the user database in an attack in July, when they demanded that Ashley Madison and its sister site Established Men, both owned by Toronto-based Avid Life Media, be taken offline, threatening to release the personal information in 30 days if their conditions were not met.

“Avid Life Media has failed to take down Ashley Madison and Established Men. We have explained the fraud, deceit and stupidity of ALM and their members. Now everyone gets to see their data,” the hackers said in a statement released with the leaked information on Tuesday.

Ashley Madison condemned the attack but did not verify whether the information was genuine. “We are actively monitoring and investigating this situation to determine the validity of any information posted online and will continue to devote significant resources to this effort,” it said.

The Guardian has independently confirmed that the email address and details of a Guardian journalist who used Ashley Madison as part of an investigation is in the released database. Others have also spoken about the validity of the information.

Brian Krebs, who broke the news of the original hack, said: “I’ve now spoken with three vouched sources who all have reported finding their information and last four digits of their credit card numbers in the leaked database.” And Rob Graham, researcher from Errata security, said he was still analysing the leaked data but agreed that “it appears legit”.

But some insist that at one stage Ashley Madison did not verify email addresses for new user accounts, which allowed the creation of many fake accounts, including those of high profile politicians. “I could have created an account at Ashley Madison with the address of barack.obama@whitehouse.gov, but it wouldn’t have meant that Obama was a user of the site,” independent security researcher Graham Cluley said.