MELISSA BLOCK, HOST:
Ashley Madison, a website that helps people cheat on their spouses, has been hacked. The site is known both for publicity stunts and its slogan, life is short; have an affair. Attackers calling themselves The Impact Team stole large caches of data from Ashley Madison, including, they say, information about users who paid to have their profiles deleted from the site. NPR's Aarti Shahani reports.
AARTI SHAHANI, BYLINE: Ashley Madison is an online dating site with a twist.
(SOUDBITE OF TV SHOW, "THE DR. DREW SHOW")
UNIDENTIFIED MAN: She only sleeps with married men.
SHAHANI: People go there to cheat.
(SOUDBITE OF TV SHOW, "THE DR. DREW SHOW")
THEA: And it's crazy. It's a whole other world than the normal dating world.
SHAHANI: Forty-two-year-old Thea, on "The Dr. Drew Show," talks about her experience.
(SOUDBITE OF TV SHOW, "THE DR. DREW SHOW")
THEA: I've gone to, you know, concerts. I've gone to the nicest restaurants. I've taken trips.
SHAHANI: After her boyfriend passed away, she says, she turned to the site. And in her nine months there, she went on 50 dates with men who were supposedly in committed relationships.
(SOUDBITE OF TV SHOW, "THE DR. DREW SHOW")
THEA: I definitely get treated a little like a princess by these guys because they're risking something by going out with me.
SHAHANI: It turns out the risk is bigger than many users expected. The so-called Impact Team broke into Ashley Madison, stole financial data, banking records and user data. Parent company Avid Life Media told customers if they paid about $20, they could erase their entire profile, scrub themselves clean. Hackers say the company was lying and leaked a bit of user account data for the world to see.
WILL GRAGIDO: There's a pattern, certainly, that suggests that extortion and ransoming is becoming more prevalent.
SHAHANI: Will Gragido is head of threat research for Digital Shadows, a San Francisco-based company that monitors the dark web.
GRAGIDO: That's very - that's very evident with respect to the type of data that we've seen exfiltrated and posted online.
SHAHANI: He says hackers could try to extract money from users of the dating site who want to keep their secret secret, though it's also possible the attack, which was reported by KrebsOnSecurity, has a moralistic motivation. Hackers are demanding the website and sibling site be shut down entirely.
GRAGIDO: I personally haven't seen that before, no.
SHAHANI: In a statement, Avid Life Media says it's working with law enforcement and private investigators, and the company is invoking copyright law to take down stolen data that's been posted on other sites. But that's kind of too little, too late. Gragido says any number of people could have made copies of that data and stored it offline.
GRAGIDO: At that point in time, the horse is out of the barn. You never know who's going to use the data for what purpose.
SHAHANI: Hackers are threatening to release data on millions of users. Earlier this year, the dating site Adult Friend Finder was also hacked. Aarti Shahani, NPR News, San Francisco. Transcript provided by NPR, Copyright NPR.
