Working with law enforcement agencies across the globe, Toronto police are appealing to the altruistic hacking community and anyone else they can find as they attempt to discover who leaked the identities of as many as 37 million users of Toronto-based infidelity website Ashley Madison.
Pushing the message home that the hack has the potential to obliterate relationships and cause significant upheaval, Toronto police assistant staff superintendent Bryce Evans said at least two recent suicides may be linked to the release of client data from the website, which advertised itself as a confidential platform for people in relationships to seek new romantic partners.
Evans said that on the morning of July 12, employees of Avid Life Media, which operates Ashley Madison, got to work and fired up their computers.
He said a “threatening message” appeared on their computer screens accompanied by the song “Thunderstruck” by rock band AC/DC. The message demanded Avid Life Media shut down the Ashley Madison site.
“The consequences for not complying with this threat would be the release of Ashley Madison’s client list, including names, profiles and credit card data,” Evans said, adding the company hired a private investigator, cybersecurity experts and contacted police.
On July 18, Avid Life Media admitted in a statement that it had been targeted by hackers seeking to reveal the identities of millions of its users across the globe.
One day later, hackers calling themselves the Impact Team released the profiles of two users, one of whom was identified as a Mississauga man.
On Aug. 17, the hackers behind the breach released a gigantic file online containing the email and home address of the 37 million people registered on the site.
Evans said police have found many profiles released online to be authentic, but have not validated all the user profiles found in the data dump.
Avid Life Media’s CEO Noel Biderman told a cybersecurity blogger in July that at least one of the people responsible for the hack was familiar with the company’s systems, though he did not think that person had ever worked for the company.
Evans said the hackers released another message last Thursday, which read “Hey, Noel, you can admit it’s real now.” The hackers also allegedly released Biderman’s business emails.
Police say they will not allow public disdain for the services the website provides to influence their investigation.
“The enormous interest in these events is based on the nature of the Ashley Madison website, but that is of no interest to the investigative team,” Evans said. “The fact that some people are offended by this service provided by Ashley Madison will not deter us from conducting a vigorous and thorough investigation.”
Police have already been made aware of several schemes involving the Ashley Madison hack, including one where hackers attempt to extort Ashley Madison users.
Evans said they have received examples of an extortion demand where an Ashley Madison user is told to pay one bitcoin, equivalent to about US$300, or else the hacker will tell everyone the user knows about their use of the Ashley Madison site.
Other scammers are offering the ability to wipe a user’s data from the trove of leaked information.
Police said that those who receive these messages should not pay up or comply, and call police immediately.
Avid Life Media is offering a $500,000 reward for information that may lead to the arrest of any member of the Impact Team.
In a statement issued Monday, the company says it is "grateful" to the international law enforcement coalition for the update on their investigation.
"In the very best interest of our customers, who have been affected by this malicious act, we are firmly committed to fully assisting these law enforcement and investigative authorities, without reserve. Because of this active and ongoing investigation, there is little more we can provide at this time to the media and the public," the statement read.
Toronto police has set up a dedicated phone line for the Ashley Madison case: 1-416-808-2040. American investigators from the FBI and Homeland Security are assisting the investigation.
Police have also appealed to what they call the “white hat” hacking community, or hackers who may feel a civic duty to help find who is responsible for the Ashley Madison breach, to assist police in finding those responsible.
“We’re talking about families, we’re talking about their children, we’re talking about wives,” Evans said. “We have now had hate crimes as a result of this. There are so many things that are happening. This is not the fun and games that’s been portrayed a lot in media outlets or live radio stations.”
