Ashley Madison hack: Data confirmed to be from infidelity site

Data posted online Tuesday claiming to contain the personal details of more than 37 million users of the infidelity dating service Ashley Madison is from a July hack of the site, even though the company will not confirm that, CBC News has learned. 

Last month, a group calling itself The Impact Team said it had hacked the self-described infidelity dating service and threatened to release its customers' names online unless Avid Life Media, the site's owners, shut it down. A message posted by the hackers accuses the company of deceit and incompetence, claiming that "the site is a scam with thousands of fake female profiles."

• Ashley Madison data reportedly posted online by hackers
• Hack unlikely to dissuade cheating spouses, says researcher
• John Oliver says affairs are 'unCanadian' in sketch mocking Ottawa

On Tuesday, the group posted what appeared to be the credit card numbers and other sensitive information of Ashley Madison's customers online. 

Avid Life Media has not confirmed validity of the data, but in a statement Tuesday it was "actively monitoring and investigating this situation to determine the validity of any information posted online."

However, sources have confirmed to CBC News that the data is from the July hack.

The data reportedly appeared first on the dark web, accessible only to people using a special browser, but has since apparently spread to more visible areas the internet. 

Inside job

Carmi Levy, a Toronto-based technology analyst, told CBC Radio's Metro Morning the hack has "all the earmarks of an inside job" by a disgruntled former employee.

"They knew where to look in order to lift the entire database," Levy said. "This is not some kid working out of his or her mom's basement. The person had advanced knowledge in order to pull something like this off."

He says the incident should make us more cautious about sharing information online.

"We willingly give away our information to pretty much anyone who asks for it online," he said. "We need to start controlling things a little more. We need to ask, 'Is this site trustworthy?' 'Do they have security protocols in place?' If it doesn't, don't share your information."

• Ashley Madison could face class-action suit after massive data breach

Avid Life Media called the release of the data "an act of criminality."

"It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities. The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror, and executioner, seeing fit to impose a personal notion of virtue on all of society," the company said.

"We will not sit idly by and allow these thieves to force their personal ideology on citizens around the world."