The adultery site claims a huge jump in membership, despite an attack that exposed 32 million members’ data, and no official explanation of what went wrong.
Ashley Madison is designed for deception. And some may question whether the “meet-and-cheat” site is telling the truth when it claims it has added millions of new members since the attack in July that revealed the personal information of its users.
But the site posted on its front page that it now has over 43,380,000 “anonymous” members, an almost 10% increase since the attack, according to a count by CNN Money.
In its last media statement at the end of August, the company that operates Ashley Madison, Avid Life Media, said it was still adding members, just weeks after the attack was made public.
“Recent media reports predicting the demise of Ashley Madison are greatly exaggerated,” the statement said “This past week alone, hundreds of thousands of new users signed up for the Ashley Madison platform – including 87,596 women.”
Why would people join now?
Whether or not the new 43,000,000+ membership number is real, cybersecurity experts say they are not surprised that people would join after the attack, even though members’ identities were revealed on the Internet, and the company has still not explained what happened.
“By nature of the service still being available, people have likely justified to themselves that the issue was fixed,” said Daniel Lance of Archer Security Group.
“This is anecdotal but I spoke to somebody and they said to me that they were joining Ashley Madison because it was more secure now,” said Patrick Malcolm with NetRunner Inc, as quoted in The Globe and Mail.
Has it been fixed?
The company has offered little explanation of what happened—and what changes it has made—in its statements on its site.
“We immediately launched a full investigation utilizing independent forensic experts and other security professionals to assist with determining the origin, nature, and scope of this attack,” it said in a statement on August 18.
“At this time, we have been able to secure our sites, and close the unauthorized access points. We are working with law enforcement agencies, which are investigating this criminal act,” it said in another statement.
“Using the Digital Millennium Copyright Act (DMCA), our team has now successfully removed the posts related to this incident as well as all Personally Identifiable Information (PII) about our users published online,” the statement continued.
The company has not added any new statements or explanations to the media section of its site since August.
So, what happened?
Some cybersecurity experts say it may have been an inside job.
“Hard to call this a ‘hacked’ website,” said Lance. “To this day, I haven’t seen or heard the attack vector used.”
“The demand was for the site to be taken down by the so called ‘hackers,’” he added. “So, why is it still up, and nothing more about a security issue has been talked about publicly? I imagine this was an internal event with a disgruntled employee feeding the information.”
There is no evidence the company has made big changes, Malcolm told The Globe and Mail.
“They knew it was an insider so there’s no reason for them to do anything to their website, which is the reason why I don’t think it’s changed,” he said in the article.
“Maybe they’ve tightened up a few practices, but again, this is the kind of thing that receives attention only when it’s a screaming baby. After the baby’s not making any noise, everybody goes back to what they were doing. That’s the typical response.”
Business as usual—and growing
Some Ashley Madison members filed lawsuits after the attack, and at least one reportedly committed suicide, according to CNN Money.
“One of the suits cites internal documents revealed by the hackers which showed employees warning the company about how vulnerable its systems were to hacking,” CNN Money reported. “Despite these warnings another suit charges that Avid CEO Noel Biderman routinely bragged in the press about his company’s computer security.”
But this may not be enough to keep people away from the site.
“I think that some people are overestimating the public’s concern with cybersecurity breaches,” said Patrick Coyle with Chemical Facility Security News.
“I think that this is much like reading about drunk driving arrests; it has some impact on the people directly affected, but is pretty much ignored by most everyone else. Most people have an attitude of ‘that stuff happens to other people, not me,’” he added.
Others say the attack may actually be contributing to a rise in membership.
“I’m not a psychologist, but I think anytime you have a limited source or ability to express, interest tends to climb,” explained Lance. “You could argue that the exposure was a good thing for the site, as the media attention likely got more people interested in the service and promoted them as being the place to go to.”