Ashley Madison staff raised security concerns before hack

Senior staff at Ashley Madison, the hacked extramarital dating site, were raising concerns over its security procedures as recently as June, just a month before the site was attacked.

Internal documents leaked as part of the attack show concerns over “a lack of security awareness across the organisation” being raised by one vice president. A database containing the documents and more than 30 million user records exfiltrated in the attack, was posted to the internet on Tuesday.

One document was a summary of results of an internal questionnaire, in which employees were asked to list “critical success factors” in their jobs, the areas where “failure to perform well” would hurt them most, and the area where they would “hate to see something go wrong”.

Kevin MacCall, the vice president of operations, listed the lack of security awareness in the last category, while Trevor Stokes, the company’s chief technology officer, listed “protection of personal information” in the first category, and “Security” in the last.

Noel Biderman, the company’s chief executive, wrote in the section on what he would hate to see go wrong: “Data exfiltration, confidentiality of the data. An insider data breach would be very harmful. Have we done good enough a job vetting everyone, are we on top of it.”

Biderman’s response was dated 17 June 2015, just one month before the company’s attackers, who call themselves Impact Team, announced that they had successfully hacked the company and were planning on releasing personal information of users if they did not close their doors.

In his initial response to the attack, Biderman implied that his greatest fear – an insider data breach – was indeed what had happened. “We’re on the doorstep of [confirming] who we believe is the culprit, and unfortunately that may have triggered this mass publication,” he told security journalist Brian Krebs in July. “I’ve got their profile right in front of me, all their work credentials. It was definitely a person here that was not an employee but certainly had touched our technical services.”

Security fears were mentioned in two other employee assessments, and privacy was mentioned in one.

The personal data that was taken from Ashely Madison is partially protected, with passwords “hashed”, a measure which prevents them being easily re-used to hack into other accounts. But information such as addresses, credit card details and sexual preferences is all stored in plain-text in the database.

Ashley Madison has yet to respond to a request for comment on internal concerns over its security procedures.

In an earlier statement after the data was made public, it said: “We are actively monitoring and investigating this situation to determine the validity of any information posted online and will continue to devote significant resources to this effort. Furthermore, we will continue to put forth substantial efforts into removing any information unlawfully released to the public, as well as continuing to operate our business.”