Nothing is safe on the Internet. Users of extramarital meetup site Ashley Madison learned this the hard way in July when the website was compromised by a hacktivist group known as the Impact Team. The cybercriminals claimed their security breach is in the public’s best interest, while critics argued that exposing highly personal details about users does much more harm than good.

Moral implications aside, this is an affair to remember for any company because it offers two key takeaways: No organization is immune from security threats, and hacktivists aren’t particularly choosy about their targets.

Site Unseen

According to Trend Micro, the Impact Team started by breaching Ashley Madison’s database and then demanded that both the original site and another affiliated site be taken down permanently. At first, the group only released bits and pieces of information — a customer record here, a corporate email there — to prove it was telling the truth.

When executives refused to cooperate, however, the cybercriminals aired the dirty laundry of users worldwide. Company secrets were also revealed: As noted by Gizmodo, Ashley Madison’s CTO allegedly hacked the database of a competing website, gained complete access and stole consumer data.

From a technical perspective, however, the Ashley Madison attacks are interesting for two reasons. First is the discovery that, to some extent, the site was actually taking steps to effectively protect users. Although they didn’t live up to the promise of paid data deletion, user passwords were encrypted when stored rather than simply saved as plaintext. Secondly, the hack revealed a number of members using either .mil or .gov email addresses, while others used corporate emails for intersite communications.

There’s enough blame to go around, but what’s interesting here is that Ashley Madison actually took some effort to mitigate the impact of a data breach; users supplying detailed and often intimate information, meanwhile, did not.

Both sides are served by the same cybersecurity effort, however: preparation. For example, the site could have asked for fewer details up front and done a better job of encrypting all stored information. Restricting data access is also a possibility, especially since there is some speculation that the hack was an inside job. Providing narrow access can help reduce the number of potentially compromised endpoints.

Here, There, Everywhere

Companies must also prepare for the fact that no industry or vertical is safe from hacktivists. Originally a term used to describe hacker groups that had a sense of social justice as their core purpose, many such groups have devolved into little more than cyber bully organizations who humiliate or punish users in an attempt to break corporate spirits.

According to the Epoch Times, for example, the Canadian government was recently targeted by hacktivist group Anonymous after a protester wearing the organization’s uniform — a Guy Fawkes mask — was shot by police. The group threatened to expose government documents unless the officer responsible was named and arrested. In effect, any group that runs afoul of Internet mob justice or clashes with hacktivist supporters can find themselves next on the security breach hit list.

So what’s the bottom line? Hacks are inevitable and largely random. This sounds like bad news but actually presents a compelling reason for organizations to take steps toward mitigation. Total defense isn’t possible, but with a combination of encryption, access control and small-scale data collection, companies can reduce the possibility of private affairs becoming public news.