by Amanda Bronstad
See full article at Texas Lawyer
Category: AshleyMadison
Ruby Corp To Pay $11M In Settlement
PR NEWSWIRE – July 14 – Ruby Corp and a proposed class of plaintiffs have reached a proposed settlement agreement resolving the class action lawsuits that were filed in July 2015 following a data breach of Ashley Madison. If the proposed settlement agreement is approved by the Court, ruby will contribute a total of $11.2M to a settlement fund, which will provide payments to settlement class members who submit valid claims for alleged losses resulting from the data breach. While ruby denies any wrongdoing, the parties have agreed to the proposed settlement in order to avoid the uncertainty, expense, and inconvenience associated with continued litigation.
See full article at PR Newswire
Ashley Madison Claims Surprising User Numbers
by Richard Morgan
See full article at NY Post
Ashley Madison: Life After The Hack
edited by Aimee Rawlins
See full article at CNN
Ashley Madison Users Are Being Blackmailed Again
by Kiarra Sylvester
See full article at Your Tango
What You Should Know About The Ashley Madison Case
OPW – Mar 13 – Courtesy of Steve Baker, formerly of the Federal Trade Commission…
Why was there a case?
In July 2015, hackers stole data of 36M AM's users and made the info public.
What was AM charged with?
- Security issues
- AM made up "trusted security award", displayed on its website
- Use of fake female profiles
- AM failed to delete users' digital trail after paying $19 for "the full delete" service.
How did the breach happen?
AM employed a virtual private network to allow remote access to its systems. To access this, you needed a password and also a "shared secret," that was common for everyone. AM did not seem to have terminated passwords for employees or contractors after they left. At least one server was not protected by a password – thus allowing access to all servers. Many passwords and encryption codes were in plain text on the servers.
What data was stolen and released?
- profile info
- passwords, including security questions and answers
- billing info and, in some cases, full credit card numbers
Effects of the AM data breach
The release of this information had a serious effect on the life of the AM members (divorces, some member were subject to extortion attempts, reportedly ~4 suicides).
What flaws did the FTC find in the AM security system?
AM failed to:
- have a written organizational information security policy
- implement reasonable access controls
- regularly monitor unsuccessful login attempts
- secure remote access
- revoke passwords for ex-employees of their service providers
- restrict access to systems based on employee's job functions
- deploy reasonable controls to identify, detect, and prevent the retention of passwords and encryption keys in clear text files
- adequately train employees to perform their data security-related services
- ascertain that third-party service providers implemented reasonable security measures to protect personal information AM allowed their employees to reuse passwords to access multiple servers and services
Does this case resolve all legal claims against AM?
No. There have been a number of class actions filed against the company.
Why is AM being singled out instead of the hackers?
AM may well contend that it is the victim here. But AM had pledged to keep the info of its members secure.
What will FTC do with the money?
The FTC recovers money in fraud cases to return to victims. If the FTC does not give money back to victims the money goes to the U.S. Treasury. The FTC keeps none of it.
What does the order require AM to do?
- no deceptive claims
- no misrepresentation of the actual number of users it has
- to have detailed and comprehensive security measures in place
- to hire a third party to perform an initial security assessment and then to do so again every two years for twenty years, and submit those reports to the FTC
- to keep appropriate records and file reports to the FTC demonstrating that it is complying with the order
Lessons for dating companies
- When you operate in many states and countries you are subject to legal action in each of these
- Data security is increasingly important
- Don't lie about how many members you have
- Don't use fake profiles or bots to urge people to sign up for paid memberships
- Hiding key information in terms and conditions is not going to prevent legal action. Be sure people actually know key information
- Make sure people know how long they are signing up for, and that they understand auto renewals
- Make sure people know how to cancel and that doing so is not difficult
- If you use third party seals make sure they are real
- Do read complaints from members
- Do your utmost to keep romance scammers off your sites
Ashley Madison’s Hack Documentary On Netflix Now
DECIDER – Feb 2 – Netflix released the documentary Ashley Madison: Sex, Lies and Cyber Attacks jarringly close to Valentine's Day (it originally aired on the UK's Channel 4 in August). Former CEO Noel Biderman did not participate in the making of the documentary.
by Jenna Marotta
See full article at Decider
Ashley Madison Says Open Minded Is Hot
PR NEWSWIRE – Jan 6 – According to Ashley Madison, people are starting the New Year with more open-minded attitudes about sexuality. Ashley Madison says "hookup" searches increased ~24% over the past year, and continued to climb during the first week of January 2017. New Year searches for "open relationships" and "open marriage" also posted double digit surges, making those search terms ones to watch in 2017.
See full article a PR Newswire
Ashley Madison Data Breach Claims Should Be Arbitrated, Company Says
NATIONAL LAW JOURNAL – Jan 5 – AshleyMadison.com's parent company is hoping to knock out ~20 class actions filed over its 2015 data breach by invoking online arbitration agreements users signed when they subscribed to its matchmaking services. According to Ruby Corp, AM parents company, users agreed to arbitrate their disputes when they set up an account on AshleyMadison.com. Lawyers are due in court on Jan 6 to schedule oral arguments on the matter.
by Amanda Bronstad
The full article was originally published at National Law Journal, but is no longer available.
Ashley Madison Settles With FTC, Agreed To Pay $1.65M Fine
BLOOMBERG MARKETS – Dec 14 – AshleyMadison.com's owner agreed to pay a steeply discounted $1.65M settlement to resolve state and federal probes into a 2015 hack that exposed personal data of 37M users. The fine was reduced ~90% from $17.5M due to an "inability to pay". Company spokeswoman Debra Quinn declined to comment on why the company can't afford to pay the full settlement, despite reporting more users than it had at the time of the breach.
by Erik Larson
See full article at Bloomberg Markets