Loading story…
Attackers published a 9.7 GB trove of stolen Ashley Madison data after an earlier extortion threat, exposing account details, names, addresses, phone numbers, partial payment records, internal company material, and bcrypt-hashed passwords tied to roughly 32 million users. Reporting said the leak appeared authentic and included thousands of .mil and .gov email addresses, raising concerns about possible exposure of military and government personnel, while researchers warned that payment records and connection logs could still identify users who believed they had remained anonymous.
The fallout quickly expanded beyond the breach itself as security firms and journalists reported blackmail emails demanding Bitcoin from exposed individuals, alongside spam, public shaming, and fears of severe personal harm. Analysts also cautioned that the dataset could not be treated as definitive proof of site use because Ashley Madison allegedly allowed weak email verification, making fake or fraudulent accounts possible; even so, researchers were able to crack some weak bcrypt-protected passwords, underscoring how poor password choices compounded the privacy and extortion risks for victims.
See attribution, scope, and your downstream exposure.
11 events from the most recent confirmed update back to the earliest known activity.
Ruby Corp, formerly Avid Life Media and owner of Ashley Madison, agreed to pay $11.2 million to settle U.S. class-action litigation stemming from the 2015 breach that exposed data on about 37 million users. The company denied wrongdoing, and the preliminary settlement still required approval from a federal judge in St. Louis.
Troy Hunt later incorporated the Ashley Madison breach into Have I Been Pwned, allowing individuals to check whether their email addresses appeared in the exposed dataset. This expanded public access to breach-notification tooling for affected users.
Analysis of the stolen password hashes showed Ashley Madison had used bcrypt, but researchers were still able to recover thousands of weak passwords after several days of cracking. The results underscored that poor user password choices remained exploitable even with stronger hashing.
By late August, spam and harassment tied to the breach were being reported, and media accounts began linking the exposure to a possible first suicide. The reporting reflected escalating real-world harm beyond the initial data leak.
Security firms observed blackmail emails sent to people whose information appeared in the breach, including demands for 1.0000001 Bitcoin to avoid disclosure to spouses or partners. Researchers had warned that the leak's sensitivity would quickly lead to coercion and exploitation.
After reports tied his information to the Ashley Madison leak, reality TV figure Josh Duggar publicly acknowledged being unfaithful to his wife. The disclosure became one of the earliest prominent examples of a named individual facing immediate reputational fallout from the breach.
Following publication of the files, Ashley Madison condemned the attack while outside experts said the leaked customer database appeared to be genuine. This marked broader public confirmation that the released data was real and highly sensitive.
Analysis of the leaked dataset found thousands of email addresses ending in .mil and .gov, raising concerns that military and government personnel were exposed. Coverage noted that the presence of such addresses did not necessarily prove all belonged to legitimate account holders.
After the company did not meet their demands, the attackers released a 9.7 GB trove of stolen Ashley Madison data on a Tor site. The dump reportedly exposed account details, names, addresses, phone numbers, passwords, and years of payment transaction records affecting roughly 32 million users.
Post-breach analysis highlighted that Ashley Madison allegedly did not properly verify email ownership, meaning some leaked accounts could have been created with other people's names or addresses. This complicated assumptions about who in the dataset was a genuine user.
Attackers known as the Impact Team compromised Ashley Madison and threatened to publish stolen data unless parent company Avid Life Media shut down Ashley Madison and Established Men. References discussing the breach aftermath indicate this initial intrusion and ultimatum occurred before late July 2015.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
19 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcetheguardian.com
Open sourceweb.archive.org
Open sourcevice.com
Open sourcewired.com
Open sourcetroyhunt.com
Open sourcegrahamcluley.com
Open sourceyahoo.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a large, publicly exposed database on an open cloud server containing **tens of millions of French citizen records** aggregated from at least five prior breaches, including voter data, healthcare entries, CRM contacts, financial profiles (including **IBANs/BICs**), and vehicle-related information. The dataset appears to have been compiled to increase resale value and enable identity cross-linking, elevating risks of **phishing, fraud, and identity theft**. Separately, Australia’s **Victorian Department of Education** notified parents that an unauthorized party accessed a student database containing names, school names, year levels, school-issued email addresses, and **encrypted passwords**, prompting a forced password reset and temporary account access disruption; the department stated more sensitive fields (e.g., home addresses, phone numbers) were not exposed and investigators had not confirmed public release. In another unrelated report, researchers questioned the veracity of a newly claimed **PayPal** breach, assessing a ~100,000-record credential “combolist” as likely **outdated infostealer-log data** rather than evidence of a fresh PayPal compromise, noting PayPal’s prior refutation of similar claims and the practical barriers posed by MFA.
Jun 29, 2026
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
A misconfigured Elasticsearch server, believed to be operated from Russia or a Russian-speaking country, was discovered leaking over 6.19 billion records to the public internet without any authentication or password protection. The exposed server contained a massive trove of 1.12 terabytes of data, including records collected from both disclosed and undisclosed data breaches, as well as information obtained through website scraping. Among the most sensitive data found were records from Ukrainian bank Accordbank, which included users’ full names, birthdates, birthplaces, addresses, phone numbers, national ID numbers, passport numbers, and tax codes. Independent cybersecurity researcher Anurag Sen was the first to identify the exposed server and report its existence to the media. The server’s index information confirmed the scale of the exposure, with over 6.19 billion records available for anyone to access. Screenshots from the server revealed that the data was stored in JSON format and included detailed personally identifiable information (PII) from various sources. The database also contained files referencing Accordbank, which were later observed being peddled by the user "tRex_Prime" on DarkForums, indicating that the data may have already been accessed and distributed by other threat actors. The leak included not only banking and contact information but also records from other breaches and data scraped from websites, making the exposure particularly broad and damaging. The server was eventually taken offline, but it remains unclear how long the data was accessible or how many unauthorized parties may have downloaded the information. Previous incidents involving hacking groups such as ShinyHunters and Nemesis were also mentioned, as they had leaked stolen data and hacking tools from other exposed cloud storage resources in the past. The incident highlights the ongoing risks associated with misconfigured cloud infrastructure and the potential for large-scale data aggregation to amplify the impact of breaches. Security experts warn that such exposed databases are prime targets for cybercriminals seeking to exploit PII for identity theft, fraud, and further attacks. The presence of both old and new breach data, as well as scraped information, demonstrates the evolving tactics of threat actors in collecting and monetizing sensitive information. Organizations are urged to regularly audit their cloud configurations and monitor for unauthorized data exposures to prevent similar incidents. The scale and sensitivity of the leaked data underscore the urgent need for improved security practices in managing large datasets, especially those containing PII from multiple sources. The incident serves as a stark reminder of the consequences of failing to secure cloud-based data storage and the far-reaching impact such exposures can have on individuals and organizations worldwide.
Jul 12, 2026