How the Ashley Madison hack happened: a stolen login and a one-factor VPN

Ashley Madison sold members a $19 "Full Delete" that was supposed to erase them, then kept their data for up to a year anyway.^[1][2] In 2015 an attacker walked in through the company's remote-access door with an employee's login and took all of it. This case file covers how the break-in worked, what regulators found once they looked inside, what it cost, and the one control that would have made the stolen login useless.

What happened

How they got in

According to the joint investigation by the privacy commissioners of Canada and Australia, the attacker used an employee's compromised credentials to log in to the company's virtual private network, or VPN, the tunnel staff used to reach internal systems from outside the office.^[2] From there the intruder gained administrator rights, deleted logs to hide their tracks, and stayed inside for at least several months before anyone noticed.^[2] The investigators described it as a targeted attack by a sophisticated intruder, not a random one.^[2]

The VPN looked like it had several locks: a username, a password, a shared secret, a group name and a server address. But every one of those was something a person knows, which makes it a single factor in security terms. Worse, the shared secret sat in a company Google Drive folder that any employee could open.^[2] Once someone had one worker's password, the rest was easy to find.

Inside, the picture was similar. Investigators found encryption keys and passwords stored as plain text on company systems, no documented information security policy, and no intrusion detection or central log monitoring. Only about 25% of staff had received security training when the breach happened.^[2] The FTC separately found that intrusions between November 2014 and June 2015 had gone undetected.^[1]

The member passwords themselves were mostly hashed with a strong algorithm, though some older ones used weaker methods.^[2] The problem was never one weak spot. It was that a single stolen login opened a network with almost nothing watching it.

What it cost

The Canadian and Australian regulators found multiple violations of both countries' privacy laws. The company signed a compliance agreement in Canada and an enforceable undertaking in Australia, and hired its first Chief Information Security Officer in October 2015.^[2]

The regulators also looked closely at Full Delete. Canadian users paid C$19 for it, and it removed profiles from view within a day or two, but the company kept the underlying information for 12 months, later cut to 6. Users only learned about the retention after paying.^[2] The homepage had also shown a "trusted security award" badge that investigators called the company's own invention.^[2]

On December 14, 2016, the operators settled with the FTC, 13 states and the District of Columbia. The judgment was $8.75 million, but the company paid $1.6 million, split between the FTC and the states, with the rest suspended.^[1] The FTC also alleged the site had used fake profiles of women to convert men into paying members, and the order required a full data security program with outside assessments.^[1]

The missing control

The missing control: multifactor authentication on remote access. The VPN let anyone with the right typed-in details onto the network, no matter where they were or what device they used.

A second factor that a thief cannot simply read, such as a code from a phone app or a physical security key, would have turned the compromised employee credentials into a dead end. The shared secret in the open Drive folder would not have mattered, because knowing it would not be enough. Better monitoring would likely have shortened the months the intruder spent inside, but stronger login at the front door is what would have kept them out in the first place.^[2]

What to do in your business

• Put a second factor on every remote door. VPN, remote desktop, email and cloud admin accounts should all require an app prompt, code or security key, not just a password.
• Get shared secrets out of shared folders. Search your file shares for documents holding passwords, VPN settings or keys, and move them into a password manager with access limited to the people who need them.
• Write down a one-page security policy. List who gets access to what, how accounts are removed when people leave, and who checks the logs. Regulators noticed that no written policy existed here.
• Make sure your promises match your practice. If you tell customers data is deleted, secure or certified, confirm that it is. The FTC treated those gaps as deception.
• Train everyone, not a quarter of staff. A short annual session on phishing and password reuse covers the most common way attackers get the first login.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.