Hackers who stole sensitive customer information from the cheating site AshleyMadison.com appear to have made good on their threat to post the data online. 
 
 A data dump, 9.7 gigabytes in size, was posted on Tuesday to the dark web using an Onion address accessible only through the Tor browser. The files appear to include account details and log-ins for some 32 million users of the social networking site, touted as the premier site for married individuals seeking partners for affairs. Seven years worth of credit card and other payment transaction details are also part of the dump. AshleyMadison.com claimed to have nearly 40 million users at the time of the breach about a month ago, all apparently in the market for clandestine hookups. 
 
 "Ashley Madison is the most famous name in infidelity and married dating," the site asserts on its homepage. "Have an Affair today on Ashley Madison. Thousands of cheating wives and cheating husbands signup everyday looking for an affair.... With Our affair guarantee package we guarantee you will find the perfect affair partner." 
 
 The data released by the hackers includes names, passwords, addresses and phone numbers submitted by users of the site, though it's unclear how many members provided legitimate details to open accounts. A sampling of the leaked data indicates that users provided random numbers and addresses to open accounts. But files containing credit card transactions likely yield real names and addresses, unless members of the site used anonymous pre-paid cards, which offer more anonymity. This data, which amounts to millions of payment transactions going back to 2008, includes names, street address, email address and amount paid, but not the full credit card numbers; instead it includes just four digits for each transaction, which may in fact be the last four digits of the credit card numbers or simply a transaction ID unique to each charge. 
 
 One analysis of email addresses found in the data dump also shows that some 15,000 are .mil. or .gov addresses. It's not clear, however, how many of these are legitimate addresses. 
 
 The data also includes descriptions of what members were seeking. "I'm looking for someone who isn't happy at home or just bored and looking for some excitement," wrote one member who provided an address in Ottawa and the name and phone number of someone who works for the Customs and Immigration Union in Canada. "I love it when I'm called and told I have 15 minutes to get to someplace where I'll be greeted at the door with a surprise—maybe lingerie, nakedness. I like to ravish and be ravished ... I like lots of foreplay and stamina, fun, discretion, oral, even willingness to experiment—*smile*" 
 
 Passwords released in the data dump appear to have been hashed using the bcrypt algorithm for PHP, but Robert Graham, CEO of Erratasec, says that despite this being one of the most secure ways to store passwords, "hackers are still likely to be able to 'crack' many of these hashes in order to discover the account holder's original password." If the accounts are still online, this means hackers will be able to grab any private correspondence associated with the accounts. 
 
 It's notable, however, that the cheating site, in using the secure hashing algorithm, surpassed many other victims of breaches we've seen over the years who never bothered to encrypt customer passwords. 
 
 "We’re so used to seeing cleartext and MD5 hashes," Graham says. "It’s refreshing to see bcrypt actually being used." 
 
 Here's how the hackers introduced the new data dump: 
 
 Kim Zetter 
 
 Following the intrusion last month, the hackers, who called themselves the Impact Team, demanded that Avid Life Media, owner of AshleyMadison.com and its companion site Established Men, take down the two sites. EstablishedMen.com promises to connect beautiful young women with rich sugar daddies "to fulfill their lifestyle needs." The hackers didn't target CougarLife, a sister site run by ALM that promises to connect older women with younger men. 
 
 "Avid Life Media has been instructed to take Ashley Madison and Established Men offline permanently in all forms, or we will release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails," the hackers wrote in a statement following the breach. 
 
 To show they meant business, they posted sample files containing some of the stolen data, which included company financial information detailing employee salaries and documents mapping the company's internal network. 
 
 The hackers appeared to target AshleyMadison and EstablishedMen over the questionable morals they condoned and encouraged, but they also took issue with what they considered ALM's fraudulent business practices. Despite promising customers to delete their user data from the site for a $19 fee, the company actually retained the data on ALM’s servers, the hackers claimed. "Too bad for those men, they’re cheating dirtbags and deserve no such discretion,” the hackers wrote. "Too bad for ALM, you promised secrecy but didn’t deliver." 
 
 Avid Life Media defiantly ignored the warnings and kept both sites online after the breach, promising customers that it had increased the security of its networks. 
 
 That wouldn't matter for the customers whose data had already been taken. Any increased security would be too little too late for them. Now they face the greatest fallout from the breach: public embarrassment, the wrath of angry partners who may have been victims of their cheating, possible blackmail and potential fraud from anyone who may now use the personal data and bank card information exposed in the data dump. 
 
 courtesy of Robert Graham 
 
 "Avid Life Media has failed to take down Ashley Madison and Established Men," Impact Team wrote in a statement accompanying the online dump Tuesday. "We have explained the fraud, deceit, and stupidity of ALM and their members. Now everyone gets to see their data.... Keep in mind the site is a scam with thousands of fake female profiles. See ashley madison fake profile lawsuit; 90-95% of actual users are male. Chances are your man signed up on the world's biggest affair site, but never had one. He just tried to. If that distinction matters." 
 
 The hackers deflected responsibility for any damages or repercussions that victims of the breach and data dump may suffer. 
 
 "Find yourself in here? It was ALM that failed you and lied to you. Prosecute them and claim damages. Then move on with your life. Learn your lesson and make amends. Embarrassing now, but you'll get over it," they wrote. 
 
 It's important to note that Ashley Madison's sign-up process does not require verification of an email address to set up an account, so legitimate addresses might have been hijacked and used by some members of the site. One email in the data dump, for example, appears to belong to former UK Prime Minister (Tony Blair). 
 
 Avid Life Media condemned the release of the data. 
 
 "This event is not an act of hacktivism, it is an act of criminality. It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities," the company said in a statement. "The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror, and executioner, seeing fit to impose a personal notion of virtue on all of society. We will not sit idly by and allow these thieves to force their personal ideology on citizens around the world." 
 
 This story was updated as it developed. ||||| Well, this should be interesting. Hackers who claim to have stolen data from Ashley Madison, the dating site for cheaters, recently posted nearly 10-gigabytes of said stolen data. That includes member email addresses, credit card transactions, and even profiles. This should be very interesting. 
 
 The data can be found on the dark web, and those who’ve already downloaded it say they’re finding all kinds of juicy gossip. (One person searched for British government emails, for instance.) The hackers themselves, however, don’t seem at all miffed about this massive release of purportedly private and possibly damaging information. Because Ashley Madison’s parent company, Avid Life Media, refused the hackers’ demand to take down the site, they don’t think the users deserve privacy. 
 
 Advertisement 
 
 Calling themselves the Impact Team, the hackers said: 
 
 We have explained the fraud, deceit, and stupidity of ALM and their members. Now everyone gets to see their data … Keep in mind the site is a scam with thousands of fake female profiles. See ashley madison fake profile lawsuit; 90-95% of actual users are male. Chances are your man signed up on the world’s biggest affair site, but never had one. He just tried to. If that distinction matters. … Too bad for those men, they’re cheating dirtbags and deserve no such discretion. Too bad for ALM, you promised secrecy but didn’t deliver.… 
 
 Advertisement 
 
 Well at least they seem honest? 
 
 Here’s a screenshot of the full statement included with the release: 
 
 Advertisement 
 
 Update (9am 08.19.2015): An Avid Life Media spokesperson posted a response on Ashley Madison’s website. The statement ensures the public that the company is “actively monitoring and investigating this situation to determine the validity of any information posted online and will continue to devote significant resources to this effort.” Then comes the tough talk: 
 
 This event is not an act of hacktivism, it is an act of criminality. It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities. The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror, and executioner, seeing fit to impose a personal notion of virtue on all of society. We will not sit idly by and allow these thieves to force their personal ideology on citizens around the world. We are continuing to fully cooperate with law enforcement to seek to hold the guilty parties accountable to the strictest measures of the law. 
 
 Meanwhile, security researchers are actively working to confirm whether or not the data is actually valid. Brian Krebs, for one, says that he’s “now spoken with three vouched sources who all have reported finding their information and last four digits of their credit card numbers in the leaked database.” So that’s pretty scary for anybody who ever thought it was a good idea to trust Ashley Madison with their super private information. 
 
 Advertisement 
 
 Update (2pm): Just in case there was any remaining doubt whether or not this data dump was legit, Ashley Madison’s parent company now confirms that at least some of it definitely is. “There has been a substantial amount of postings since the initial posting, the vast majority of which have contained data unrelated to AshleyMadison.com, but there has also been some data released that is legitimate,” Avid Life spokesman Paul Keable told Reuters. 
 
 Update (6:20pm): Welp… 
 
 Advertisement 
 
 [Wired, Ars Technica] 
 
 Image via Ashley Madison 
 
 Contact the author at adam@gizmodo.com. 
 
 Public PGP key 
 
 PGP fingerprint: 91CF B387 7B38 148C DDD6 38D2 6CBC 1E46 1DBF 22 ||||| Gigabytes worth of data taken during last month's hack of the Ashley Madison dating website for cheaters has been published online—an act that could be highly embarrassing for the men and women who have used the service over the years. 
 
 A 10-gigabyte file containing e-mails, member profiles, credit-card transactions and other sensitive Ashley Madison information became available as a BitTorrent download in the past few hours. Ars downloaded the massive file and it appeared to contain a trove of details taken from a clandestine dating site, but so far there is nothing definitively linking it to Ashley Madison. User data included e-mail addresses, profile descriptions, addresses provided by users, weight, and height. A separate file containing credit card transaction data didn't include full payment card numbers or billing addresses. 
 
 Rob Graham, CEO of Errata Security, said the dump also included user passwords that were cryptographically protected using the bcrypt hashing algorithm. That's among the most secure ways to store passwords, because bcrypt is extremely slow, a trait that requires crackers to devote vast amounts of time and computing resources. Still, it's highly likely a large percentage of the hashes will be cracked, given rampant use of weak passwords. That will go a long way to preventing the cracking of even moderately weak passwords, although "1234567" "password" and the other mostly widely used passcodes will likely fall after some time. 
 
 Ashley Madison officials have stopped short of confirming the published information was extracted from the breach. 
 
 "We have now learned that the individual or individuals responsible for this attack claim to have released more of the stolen data," they wrote in an e-mail to Ars. "We are actively monitoring and investigating this situation to determine the validity of any information posted online and will continue to devote significant resources to this effort. Furthermore, we will continue to put forth substantial efforts into removing any information unlawfully released to the public, as well as continuing to operate our business." 
 
 As the screenshot above indicates, the dump contains files with titles including "aminno_member_dump.gz," "aminno_member_email.dump.gz," "CreditCardTransactions7z," and "member_details.dump.gz," an indication that the download could contain highly personal details. 
 
 People have already taken to 8chan and other sites to discuss the contents of the data. Their posts unsurprisingly report that many of the names and other identifying information appear to be falsified. AshleyMadison.com claimed it had almost 40 million users at the time of last month's breach. It's 
 
 Assuming the download turns out to be authentic, people should remember that it was possible for anyone to create an account using the name and e-mail address of other individuals. That means an entry for a given individual doesn't automatically prove the person was behind it. Still, it would be harder for hoaxters to falsify credit card transactions and member profiles. As a result, the data could prove devastating if used by divorce attorneys, blackmailers, and others. This post will be updated as this story develops. 
 
 The full text of Ashley Madison's e-mail is: 
 
 Last month we were made aware of an attack to our systems. We immediately launched a full investigation utilizing independent forensic experts and other security professionals to assist with determining the origin, nature, and scope of this attack. Our investigation is still ongoing and we are simultaneously cooperating fully with law enforcement investigations, including by the Royal Canadian Mounted Police, the Ontario Provincial Police, the Toronto Police Services, and the U.S. Federal Bureau of Investigation. We have now learned that the individual or individuals responsible for this attack claim to have released more of the stolen data. We are actively monitoring and investigating this situation to determine the validity of any information posted online and will continue to devote significant resources to this effort. Furthermore, we will continue to put forth substantial efforts into removing any information unlawfully released to the public, as well as continuing to operate our business. This event is not an act of hacktivism, it is an act of criminality. It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities. The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror, and executioner, seeing fit to impose a personal notion of virtue on all of society. We will not sit idly by and allow these thieves to force their personal ideology on citizens around the world. We are continuing to fully cooperate with law enforcement to seek to hold the guilty parties accountable to the strictest measures of the law. Every week sees new hacks disclosed by companies large and small, and though this may now be a new societal reality, it should not lessen our outrage. These are illegitimate acts that have real consequences for innocent citizens who are simply going about their daily lives. Regardless, if it is your private pictures or your personal thoughts that have slipped into public distribution, no one has the right to pilfer and reveal that information to audiences in search of the lurid, the titillating, and the embarrassing. We know that there are people out there who know one or more of these individuals, and we invite them to come forward. While we are confident that the authorities will identify and prosecute each of them to the fullest extent of the law, we also know there are individuals out there who can help to make this happen faster. Anyone with information that can lead to the identification, arrest, and conviction of these criminals, can contact information@avidlifemedia.com. 
 
 Post updated throughout to add newly available information.
– The hackers behind last month's data breach of AshleyMadison.com, one of the foremost websites for "married individuals seeking partners for affairs," have posted the stolen data online, Wired reports. The 9.7 gigabytes of information posted on the "dark web" seem to include account details, log-ins, and payment transactions for at least some of what the company claimed were 40 million users. As Gizmodo observes, "this should be very interesting." The hackers say they released the stolen data to show the "fraud, deceit, and stupidity" of AshleyMadison.com and its users. Ars Technica has downloaded the file and notes that while it does indeed appear to come from a "clandestine dating site," there's no definitive link to Ashley Madison. The company hasn't confirmed and says it is "actively monitoring" the situation. Gizmodo reports people are already finding "juicy gossip" amid the leaked data, including one person who turned up a plethora of British government email addresses. AshleyMadison.com doesn't require email verification to create an account, so anyone could create one using someone else's name and email address. Still, expect divorce attorneys and blackmailers to take notice, notes Ars Technica.