Blog

An insider could have been behind the huge hack on infidelity dating site Ashley Madison.

News broke last month of a hack that saw customer data stolen from Ashley Madison – a hugely controversial site that allows married individuals to organise affairs. Now, with the site still operational but many users fearing the leak of this information, it has been claimed that the hack most probably came from within the company and not a third party.

Cyber security lecturer Dr Daniel Dresner explained: “Doors are opened up from someone on the inside. This might just be an excuse, but so many of the actual attacks we see are opened up by somebody [inside].”

Despite the site’s controversial offering, it wasn’t the infidelity that drove hackers to steal user data but instead its suspect business practices.

The so-called ‘Impact Team’ hacking group specifically highlighted Ashley Madison’s practice of charging users to delete their accounts. Furthermore, users were told that paying for this service would see all of their information removed from Ashley Madison’s servers – something the Impact Team argues isn’t true. To prove their point, the hackers claim they even have personal information (such as names, addresses, credit card information and even secret fantasies) from those who had previously requested account deletion.

Account deletions – too little too late?

As a short-term solution, the site’s owners (tagline: ‘Life is short, have an affair’) offered free account cancellations. It’s not been revealed how many people took up this offer, but with the data having already been stolen it matters little should this information see the light of day.

Several weeks after the hack, both parties were still engaged in an ongoing standoff. The hackers said they would keep the data to themselves if Ashley Madison owners, Avid Dating Life, closed down the site. Ashley Madison, however, is still live and boasting having 38 million members. If the standoff continues it will work in Ashley Madison’s favour, as those who tried to access this hacked data have found it increasingly difficult – if not impossible – to find. Instead, they are being served ads and religious propaganda.

Security breaches can cost a business much more than its reputation, according to a new study, and the number of businesses affected by cyber-attacks is on the rise.

According to a government-commissioned report from consultancy firm PwC, British companies could see security breaches leave them out of pocket to the tune of almost £1.5 million – at least for larger organisations. It said that average ‘starting costs’ for major breaches at large firms had more than doubled in the past year alone, growing from £600,000 to £1.46 million.

Whilst the number isn’t quite so high for smaller firms, as a percentage of their turnover it’s still an eye-watering amount. Small businesses suffering with the most extreme security breaches could end up with a bill of £310,000 – significantly more than the £115,000 that a similar breach in 2014 would have cost.

Perhaps unsurprisingly, one in ten companies that had suffered a breach said they’d changed the nature of their business as a result.

90% of large firms and 74% of SMEs affected

PwC also reiterated that the old belief of “that won’t happen to me” is risky at best, and a recipe for total disaster at worst. It claimed that 90 per cent of large organisations had suffered some sort of cyber-attack over the past year, a nine per cent year-on-year increase. It was a similar story for smaller firms – with 74 per cent having fallen victim of an attack, growing from the 60 per cent total recorded in 2014.

Much of this could be attributed to the diversity of devices being used in today’s workplaces. Companies are investing in security for their desktop devices, but neglecting to roll out such measures for tablets and smartphones. There are also intangible risks much more difficult to protect against, like human error. Staff-related breaches have hit 75 per cent of large businesses, a figure that was nearer 60 per cent last year.

Commenting, PWC cyber security director Andrew Miller told telegraph.co.uk: “Breaches are becoming increasingly sophisticated, often involving internal staff to amplify their effect, and the impacts we are seeing are increasingly long-lasting and costly to deal with.”

We recommend working closely with your IT provider to minimise the risk of a cyber-security breach and being vigilant when opening emails and attachments. Give us a call on 01293 871971 to discuss your security options.