August 25, 2015 By Douglas Bonderud 2 min read

Nothing is safe on the Internet. Users of extramarital meetup site Ashley Madison learned this the hard way in July when the website was compromised by a hacktivist group known as the Impact Team. The cybercriminals claimed their security breach is in the public’s best interest, while critics argued that exposing highly personal details about users does much more harm than good.

Moral implications aside, this is an affair to remember for any company because it offers two key takeaways: No organization is immune from security threats, and hacktivists aren’t particularly choosy about their targets.

Site Unseen

According to Trend Micro, the Impact Team started by breaching Ashley Madison’s database and then demanded that both the original site and another affiliated site be taken down permanently. At first, the group only released bits and pieces of information — a customer record here, a corporate email there — to prove it was telling the truth.

When executives refused to cooperate, however, the cybercriminals aired the dirty laundry of users worldwide. Company secrets were also revealed: As noted by Gizmodo, Ashley Madison’s CTO allegedly hacked the database of a competing website, gained complete access and stole consumer data.

From a technical perspective, however, the Ashley Madison attacks are interesting for two reasons. First is the discovery that, to some extent, the site was actually taking steps to effectively protect users. Although they didn’t live up to the promise of paid data deletion, user passwords were encrypted when stored rather than simply saved as plaintext. Secondly, the hack revealed a number of members using either .mil or .gov email addresses, while others used corporate emails for intersite communications.

There’s enough blame to go around, but what’s interesting here is that Ashley Madison actually took some effort to mitigate the impact of a data breach; users supplying detailed and often intimate information, meanwhile, did not.

Both sides are served by the same cybersecurity effort, however: preparation. For example, the site could have asked for fewer details up front and done a better job of encrypting all stored information. Restricting data access is also a possibility, especially since there is some speculation that the hack was an inside job. Providing narrow access can help reduce the number of potentially compromised endpoints.

Here, There, Everywhere

Companies must also prepare for the fact that no industry or vertical is safe from hacktivists. Originally a term used to describe hacker groups that had a sense of social justice as their core purpose, many such groups have devolved into little more than cyber bully organizations who humiliate or punish users in an attempt to break corporate spirits.

According to the Epoch Times, for example, the Canadian government was recently targeted by hacktivist group Anonymous after a protester wearing the organization’s uniform — a Guy Fawkes mask — was shot by police. The group threatened to expose government documents unless the officer responsible was named and arrested. In effect, any group that runs afoul of Internet mob justice or clashes with hacktivist supporters can find themselves next on the security breach hit list.

So what’s the bottom line? Hacks are inevitable and largely random. This sounds like bad news but actually presents a compelling reason for organizations to take steps toward mitigation. Total defense isn’t possible, but with a combination of encryption, access control and small-scale data collection, companies can reduce the possibility of private affairs becoming public news.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today