In August 2015, a group calling itself The Impact Team published the details of approximately 36 million Ashley Madison user accounts. That figure comes from a 2016 joint report by the Office of the Privacy Commissioner of Canada and the Office of the Australian Information Commissioner, which remains the cleanest starting point for the breach in numbers.
The file people still call “the Ashley Madison list” was never a list of verified users. The company told those regulators it “did not, and does not, verify the email addresses provided by users”.
It called that “a deliberate and considered decision”.
That distinction matters because account totals and email totals are different measures. Have I Been Pwned counts 30,811,934 unique email addresses in the leak, 14.4% fewer than the 36 million accounts.
That gap is our own calculation.
The legal numbers also became part of the public record. The class action that followed advertised up to $3,500 per person.
By October 18, 2017, the settlement administrator had processed 2,522 claims.
This page traces the numbers people repeat about the breach to the regulators, the court record and the archived website, and adds two analyses of our own. This page names nobody, and it does not explain how to search the data.
If you are here because of the site itself rather than the breach, our Ashley Madison review covers what it costs and how it works today.
Ashley Madison Data Breach: Key Statistics
The figures below come from the Canadian and Australian privacy commissioners’ joint report, the FTC, the federal court order approving the class settlement, Have I Been Pwned, Gizmodo, and our own analysis of archived copies of the Ashley Madison homepage. Together, they show a breach that exposed account records at large scale, revealed weak identity and security controls, and produced penalties and settlements that were small beside the number of people affected.
- Approximately 36 million user accounts were published on August 18 and 20, 2015.
- ALM, the company then running the site, had 2014 operating revenues above US$100 million and around 100 staff.
- The company never verified the email addresses users typed in.
- Have I Been Pwned lists 30,811,934 unique email addresses, 14.4% fewer than the account count, in our analysis.
- The data held 13 kinds of personal information, from dates of birth to sexual orientations and payment histories, according to Have I Been Pwned.
- Users paid $19 for a “Full Delete”, and the company then kept their data for another 12 months.
- About 75% of the company’s staff had not received security training when the breach happened.
- Intruders were in the network several times between November 2014 and June 2015, according to the FTC.
- A password-cracking team recovered more than 11.2 million passwords within weeks of the leak.
- The FTC alleged that until August 2014 the site used fake female “engager” profiles to convert men into paying members.
- 70,529 of the 70,572 bot accounts found in the leaked code posed as women, according to Gizmodo.
- The FTC and state settlement came to $17.5 million before it was suspended, and the company paid $1,657,000, which is 9.5% in our analysis.
- That payment works out to 4.6 cents per exposed account, in our analysis.
- The class action fund was $11.2 million, and one third, $3,733,333.33, went to the lawyers.
- 2,522 claims had been processed by October 18, 2017, one for every 7,534 American users the FTC counted, in our analysis.
- The homepage counter grew by 1.08 million sign-ups a month in the five months after the hack, against 0.77 million a month before it, in our analysis of the company’s own counter.
Ashley Madison Hack Timeline, From Intrusion to Settlement
The Ashley Madison breach did not enter the public record at a single point. The chronology starts with repeated access to the network, then moves to an internal detection event, an extortion announcement, regulator notice, publication of data, password recovery reports, privacy findings, and settlements.
That sequence matters because the exposed material included account data, company emails, and source code.
The sources below do different jobs. The FTC records the undetected access period and its settlement with the company, while the Canadian and Australian privacy regulators document the detection, notification, and publication timeline.
The password recovery comes from Ars Technica’s report on the CynoSure Prime team, and the federal court record marks the approval of the class settlement.
| Date | What happened | Source |
| November 2014 to June 2015 | Intruders access the network several times without being detected | FTC |
| July 12, 2015 | Staff detect unusual activity in the database management system | OPC and OAIC |
| July 15, 2015 | The Impact Team announces the hack and demands that Ashley Madison and Established Men shut down | OPC and OAIC |
| July 20, 2015 | ALM reports the breach to the Privacy Commissioner of Canada | OPC and OAIC |
| August 18 and 20, 2015 | Data on about 36 million accounts, company emails and source code are published | OPC and OAIC |
| September 10, 2015 | A cracking team reports more than 11.2 million passwords recovered | Ars Technica |
| August 2016 | Canadian and Australian regulators publish their joint findings | OPC and OAIC |
| December 14, 2016 | FTC and state settlement, $1.6 million paid | FTC |
| November 20, 2017 | Federal court gives final approval to the $11.2 million class settlement | US District Court, E.D. Missouri |
The attribution question remained unresolved. Krebs on Security reported that the company later offered a $500,000 reward, and that as of July 2022 no one had been charged in connection with the hack.
The people behind the intrusion and publication of the data were never identified in the public record cited here.
What the Ashley Madison List Actually Contained
The Ashley Madison breach exposed several different kinds of records at once. The regulators sorted the published personal data into three categories: profile information, account information, and billing information.
That distinction matters because each category carried a different level of detail about the people attached to the service.
Profile information was the material users entered about themselves. It included user name, zip or postal code, relationship status, gender, height, weight, body type, ethnicity, and what they were looking for.
Some of that information described identity, while other fields described preferences or self-presentation on the site.
Account information was tied to access and login systems. It included email addresses, security questions and answers, and hashed passwords.
This category was separate from the public-facing profile fields because it held login credentials and account recovery details.
Billing information covered a subset of users who paid. The regulators described real names, billing addresses, and the last four digits of card numbers in this part of the data.
They also wrote that the billing data’s format “strongly suggests” the source was a payment processor the company used.
The regulators added one narrow payment detail. “A small number of full credit card numbers” appeared in the data because users had typed them into a free-text field.
That made those entries different from the regular billing fields, which were described as holding only the last four digits of card numbers.
Have I Been Pwned lists 13 data classes for the breach: dates of birth, email addresses, ethnicities, genders, names, passwords, payment histories, phone numbers, physical addresses, security questions and answers, sexual orientations, usernames, and website activity. Have I Been Pwned also flags the breach as sensitive, which means it is not publicly searchable.
The published material also included more than user records. Corporate files released at the same time included emails, source code, and other business documents.
Those files concerned the company’s operations, separate from the profile, account, and billing records tied to users.
The table below separates the main buckets of information. It does not identify any individual, and it keeps the focus on the kinds of data the breach exposed.
| Category | What it included | Who it covered |
| Profile | User name, zip or postal code, relationship status, gender, height, weight, body type, ethnicity, and what users were looking for | Users who entered profile information |
| Account | Email addresses, security questions and answers, hashed passwords | Users with account records |
| Billing | Real names, billing addresses, and the last four digits of card numbers | A subset of users who paid |
| Corporate files | Emails, source code, business documents | The company |
Why the List Is Not Proof That Anyone Used the Site
The safest reading of the leaked account table is narrow. An email address in that file proves only that someone typed the address into a sign-up form.
It does not prove that the person who controlled the address created the account, paid for anything, or used the site.
This distinction is easy to lose because an email address looks personal. In this breach, the field was whatever someone typed at registration, and the company never confirmed it.
Treating it as a verified identity would add a check that the company said it did not perform.
The reason is in the regulators’ report. The company told the regulators, “ALM confirmed that it did not, and does not, verify the email addresses provided by users.”
The same report described that policy as “a deliberate and considered decision by the company to forgo such verification in order to provide users with anonymity.”
That choice changes what the leak can prove. Without email verification, the address field could include typos, borrowed addresses, old addresses, throwaway addresses, and addresses entered by someone other than the account holder.
The regulators wrote that a subset of the leaked addresses “reportedly belonged to people who had never used Ashley Madison”.
The court record pointed the same way. The federal judge approving the class settlement wrote that the email and street addresses in the data were “apparently not” 100% accurate.
That wording matters because street addresses looked more concrete than email addresses, but the settlement record still treated the data with caution.
Counts tell the same story from another angle. Have I Been Pwned, which de-duplicates addresses, counts 30,811,934 unique email addresses.
The regulators and the FTC counted approximately 36 million accounts. Our analysis of those counts gives a gap of 5,188,066 addresses, or 14.4%.
That gap does not identify a clean category. It means many accounts either shared an address or carried an address that could not be used, and the public counts do not let us split those causes.
For a statistics article, the safest label is accounts. No count of verified people exists.
The account total and the unique-address total also measure different things. An account count can include repeated addresses, malformed entries, and records attached to addresses that never led back to the person named by the address.
A unique email count removes duplicates, but it does not turn an unverified address into a verified user.
Billing records require a different standard. They came from payment data and carried real names and billing addresses, but only for “a subset of users who made purchases.”
That makes billing data more tied to a purchaser than an unverified email address, while still covering only part of the leaked user base.
The same distinction matters for public interpretation. A billing record may show a purchase record, while an email-only account record may show only that a string was accepted by the sign-up system.
Mixing those sources makes the leak sound cleaner than the underlying data were.
Deactivated accounts add another limit. They were still in the data because the company kept deactivated profiles indefinitely.
That means an account’s presence in the leak does not tell us whether it was active when the breach occurred.
| Measure | Count | Source |
| Accounts in the leak | approximately 36 million | OPC and OAIC, FTC |
| Unique email addresses | 30,811,934 | Have I Been Pwned |
| Gap | 5,188,066 (14.4%) | Our analysis |
| Users notified by email in Canada | 1.03 million | OPC and OAIC |
| Users notified by email in Australia | 0.67 million | OPC and OAIC |
None of this tells anyone whether a particular person used the site.
Infidelity itself is measured far better in surveys than in any leaked file. Our analysis of who cheats more, men or women uses the General Social Survey instead.
The $19 Full Delete, and What the Company Kept
Ashley Madison gave users a free basic deactivation and a paid Full Delete. For Canadian users, the fee was C$19.
The FTC complaint described users “who had paid $19 for a ‘Full Delete’ service.”
The privacy policy and the terms and conditions did not say a fee would be charged to delete. That made the charge harder to see before a user reached the deletion flow.
The record uses both C$19 and $19, reflecting the Canadian fee and the wording in the FTC complaint.
After a customer paid, the account data did not disappear from company systems. It was hidden from the site within 24 to 48 hours, then “retained by ALM for a further 12 months.”
Users learned about that added retention only after paying for the service.
The photo retention failure made the gap between the label and the back end more concrete. Regulators said that, “Due to an error,” photos from deleted accounts had not been deleted after the 12 months and “may have been accessed by the attacker.”
A paid deletion product still left material exposed in the breach record.
Deactivated profiles followed an even longer path. They were kept indefinitely, and the company defended that practice with its own reactivation figure: of users who reactivated, “99.9% of these users did so within 29 days.”
The same retention defense also pointed to chargebacks, with around 98% arriving within 6 months, around 2% between 6 and 12 months, and 0.1% after 12 months.
| Company Figure | Value | What It Was Used to Argue |
| Reactivations within 29 days | 99.9% | keeping deactivated profiles |
| Chargebacks within 6 months | around 98% | keeping data 12 months |
| Chargebacks after 12 months | 0.1% | same |
| Retention after full delete, after the breach | 6 months (was 12) | the change the company made |
Regulators found those figures did not justify keeping deactivated profiles indefinitely. They accepted that the company had a reasonable basis for keeping data for a limited period after a full delete, to deal with fraud.
Their objection was that users were told about the extra 12 months only after they had paid.
After the breach, the company cut retention after a full delete from 12 months to 6. That change did not erase the earlier exposure, but it showed how the deletion system could have used a shorter period.
The later class settlement paid $19 per Full Delete purchase, up to $500 for multiple accounts.
How the Hackers Got In
The published findings point to a basic entry point. The attacker got in through the company’s VPN, where access depended on a “shared secret,” a single passphrase used by every VPN user.
That setup put a lot of weight on one credential. The regulators did not describe a separate passphrase for different VPN users, and the breach findings focused on that shared access design.
The regulators also described routine secrets stored in unsafe places. They found passwords stored “as plain, clearly identifiable text in emails and text files,” encryption keys stored as plain text, and a server with an SSH key that was not password protected.
Training and policy gaps went together. About 75% of staff had not received security training, written security policies were not in place when the breach happened, and the FTC said the company had no written information security policy.
The company also lost part of the record of what happened. The attacker deleted logs, so the company could not fully work out the path the attacker took.
The company believes the attacker had access for “at least several months.”
The public security messaging told a different story. The front page carried a medal icon labelled “trusted security award,” an “SSL secure” lock, and a “100% discreet service” claim.
The FTC charged the award as a misrepresentation, and the icon and the 100% claim were later removed.
User passwords were hashed with bcrypt, except for some legacy passwords. A cracking team called CynoSure Prime recovered more than 11.2 million of those passwords by going after a legacy token stored alongside the bcrypt hashes, Ars Technica reported on September 10, 2015.
The team did not release the passwords.
| Weakness | What the Regulators or the FTC Found |
| VPN access | one shared passphrase for all users |
| Stored secrets | passwords and encryption keys in plain text files |
| Training | about 75% of staff untrained |
| Policy | no written information security policy (FTC) |
| Marketing | a “trusted security award” the FTC called a misrepresentation |
The Engager Bots and the “12,000 Women” Claim
The bot findings are one of the easiest parts of the breach story to misread. The account dump contained user records, fake profiles, and automated contact systems in the same broad data story.
Treating one database field as a clean count of real people created a number that later had to be pulled back.
The FTC complaint is specific. It said that until August 2014 the site “lured customers, including 19 million Americans, with fake profiles of women designed to convert them into paid members.”
The FTC called those fake accounts “engager profiles.”
Gizmodo then read the leaked source code and reported 70,572 bot accounts. Of those, 70,529 posed as women and 43 as men.
Gizmodo also reported that “20 million men out of 31 million received bot mail” and that “about 11 million of them were chatted up.”
| Figure | Value | Status |
| bot accounts in the code | 70,572 | Gizmodo, from leaked code. |
| Bots posing as women | 70,529 | Gizmodo. |
| Men who received bot mail | 20 million of 31 million | Gizmodo. |
| Female accounts | 5.5 million | Gizmodo. |
| “About 12,000 real women” | withdrawn | its author called it a misunderstanding. |
Those counts describe automated contact. They do not give a direct headcount of who used the site as a human participant.
The leaked database also held 5.5 million female accounts, according to Gizmodo. A database account is not the same thing as a verified person.
That distinction is why the bot evidence and the female account count have to be read as different measures.
The “about 12,000 real women” figure came from an earlier Gizmodo story and became one of the most repeated claims from the breach. Its author later withdrew that interpretation.
The correction matters because the low number came “based in part on a misunderstanding of the evidence.”
The fields behind it recorded the last time a bot, which the company called an engager, emailed or chatted with a member. They did not record what human members did, so they could not count active women at all.
For our analysis, the safest reading is narrow. The breach exposed a large engager system, documented by the FTC and by Gizmodo’s code reporting.
It did not prove that the site had only “about 12,000 real women,” because that claim was withdrawn by the person who produced it.
The later class settlement treated this as a money issue tied to paid interaction. It paid up to $500 to users who believed they spent credits talking to engagers or bots.
That payment category was tied to claimed spending on artificial contact.
Fake profiles are not unique to this site. Our romance scam statistics cover the losses the FTC records from dating fraud.
What the Breach Cost Ashley Madison in Court
In court, the breach produced separate money tracks, a regulator settlement and a class action settlement. The FTC press release dated December 14, 2016 said the operators paid “a total of $1.6 million to settle FTC and state actions.”
The court order gives the fuller accounting: a $17,500,000 settlement, “partially suspended” because the company could not pay more than $1,657,000. The FTC release shows the federal part, an $8.75 million judgment suspended on payment of $828,500, with another $828,500 going to 13 states and the District of Columbia.
The gap is large. The headline settlement was $17,500,000, while the amount collected was $1,657,000.
Our analysis puts that payment at 9.5% of the judgment. Spread across approximately 36 million accounts, it came to 4.6 cents per account.
The class action followed a separate path. In MDL 2669, in the Eastern District of Missouri, the court gave final approval on November 20, 2017 to an $11.2 million non-reversionary fund.
The order set out several claim categories:
- $19 per Full Delete purchase, up to $500 for multiple accounts.
- Credits spent on engagers, up to $500.
- Other losses, including identity theft, up to $2,000.
- The remainder split among people whose data was released, up to $500.
Payments were pro rata, with at most $3,500 per person. The widely repeated “$3,500 per victim” figure was the cap on a pro rata payout, and the order publishes no average payment.
The actual payment depended on the category of claim, the proof submitted, and how the fund was divided.
The fund also paid the legal side of the case. Lawyers’ fees were one third of the fund, $3,733,333.33.
Costs were $78,032.38, and $5,000 went to each named plaintiff.
The notice effort was large in media terms. The settlement notice ran as 11,578,658 banner ad impressions on more than 42,700 websites.
It also included print notices in People and Sports Illustrated, with an estimated reach of 75.3%.
The claims count in the record was small, though the deadline had not passed. The order states, “As of October 18, 2017, the Settlement Administrator has received and processed a total of 2,522 claims.”
That figure was still open-ended at the time of the filing.
Set against the 19 million Americans the FTC counted, 2,522 claims equals 13.3 claims per 100,000, or one claim per 7,534. Because claims were still open, our analysis treats that rate as a floor.
The final claims rate was never published.
The money record is more restrained than the public memory of the breach. The court files show a large suspended FTC judgment, a smaller regulator payment, and a class fund with caps, fees, costs, and pro rata limits.
They do not give a published average payout to exposed account holders.
| Item | Amount | Source |
| FTC and state settlement, before suspension | $17,500,000 | court order |
| Amount paid to the FTC and states | $1,657,000 | court order |
| Share paid | 9.5% | our analysis |
| Per exposed account | 4.6 cents | our analysis |
| Class fund | $11.2 million | court order |
| Lawyers’ fees | $3,733,333.33 | court order |
| Claims processed by October 18, 2017 | 2,522 | court order |
Did the Breach Hurt Ashley Madison? What the Homepage Counter Shows
To test whether the breach visibly damaged Ashley Madison’s own growth story, we built an original series from the public homepage. We read archived copies of the Ashley Madison homepage in the Internet Archive, month by month from January 2014 to October 2017, and recorded the member counter it displayed.
The first caution is that this counter is the company’s own marketing number. It counts sign-ups, it never counts deletions, and the email addresses behind it were never verified.
It measures what the company wanted visitors to see. It does not measure active users.
That limit matters because the counter kept rising after the breach became public. On January 1, 2014, the homepage showed 23,235,000.
On January 3, 2015, it showed 31,405,000. On July 20, 2015, the day the company reported the breach to the regulator, it showed 37,610,000.
| Snapshot Date | Counter | Monthly Pace Since Previous Row |
| January 1, 2014 | 23,235,000 | n/a |
| July 20, 2015 | 37,610,000 | 0.77 million |
| January 1, 2016 | 43,465,000 | 1.08 million |
| January 1, 2017 | 50,685,000 | 0.60 million |
| October 3, 2017 | 55,800,000 | last counter shown |
The pattern is plain in the archived homepage series. From January 2014 to July 2015, the displayed counter rose at 0.77 million a month.
From July 2015 to January 2016, after the breach was reported, the pace was 1.08 million a month. During 2016, the pace was 0.60 million a month.
In other words, the claimed number grew faster in the five months after the hack than it had before the hack. That does not mean the breach helped the company in any broader business sense.
It means the public counter, as a marketing claim, did not stop moving upward after the worst point in the story.
The regulator’s figure gives one useful check on scale. Regulators counted approximately 36 million profiles at the time of the breach, close to the 37,610,000 shown on the homepage counter that day.
The two figures are not identical measures, but they are close enough to show that the homepage number was in the same range as the profile count described by regulators.
After October 3, 2017, the homepage snapshot in our series no longer gives the same running counter. The counter disappears from the homepage in 2018.
In January 2024, the homepage said “80 million sign-ups since 2002.” In 2026, its title says “91 Million Like-minded Members* joined since 2002.”
So the counter answers a narrow question. It shows that Ashley Madison never stopped reporting growth on its own public homepage.
It cannot show how many real, paying people stayed, how many accounts were abandoned, or how many listed email addresses belonged to people who had any continuing connection to the site.
For how the wider dating app market grew over the same years, see our dating app statistics.
How the Ashley Madison Breach Compares With Other Dating-Site Breaches
In our second original analysis, we used Have I Been Pwned as the starting point for a dating breach comparison. The site lists 1,038 breaches, of which 94 are flagged as sensitive.
We then classified 20 of the 94 as dating, hookup or affair sites.
We left out 4 of the 20 dating entries because they are unverified or flagged as fabricated. The remaining 16 are verified and not fabricated, and together they account for 307,342,103 accounts.
This gives a narrower comparison set than a list of all sensitive breaches.
Ashley Madison ranks 3rd of the 16 verified dating breaches by account count. Its 30,811,934 accounts make up 10.0% of the total in that group.
It sits below Adult FriendFinder from 2016 and Fling from 2011, and above Mate1.com from 2016 and Zoosk from 2020.
Account count is one way to compare these incidents. Data classes add another view because they describe the kinds of information exposed.
Adult FriendFinder in 2016 exposed 4 data classes, while Ashley Madison exposed 13. Mate1.com recorded 25 data classes, and Zoosk from 2020 recorded 17.
| Breach | Year | Accounts | Data classes |
| Adult FriendFinder | 2016 | 169,746,810 | 4 |
| Fling | 2011 | 40,767,652 | 11 |
| Ashley Madison | 2015 | 30,811,934 | 13 |
| Mate1.com | 2016 | 27,393,015 | 25 |
| Zoosk | 2020 | 23,927,853 | 17 |
| Adult FriendFinder | 2015 | 3,867,997 | 10 |
| MobiFriends | 2020 | 3,512,952 | 5 |
| Beautiful People | 2015 | 1,100,089 | 20 |
The table shows why Ashley Madison remains one of the central dating-site breach cases, even though it was not the largest by account count. Adult FriendFinder in 2016 was far larger on accounts, but its data-class count was much smaller than Ashley Madison’s.
The comparison also shows how smaller account totals can still involve broad data exposure. Beautiful People had 1,100,089 accounts and 20 data classes.
Mate1.com had fewer accounts than Ashley Madison, but more data classes. For readers comparing breach size, both columns matter.
What Changed After the Breach
After the breach, ALM changed parts of its security management, access controls, data retention, and marketing language. The joint Canadian and Australian report said the company “subsequently took significant measures to improve its information security.”
That wording is careful, and this section keeps the same limit.
The first organizational change came in October 2015, when ALM hired an experienced Chief Information Security Officer. The role reported directly to the chief executive and replaced the previous Director of Security.
In the same month, ALM engaged Deloitte to review its security framework, followed by documented policies and procedures and additional staff training.
Access controls also changed. ALM added a second factor of authentication for remote VPN access, described by regulators as “something you have.”
The joint report said that second factor was appropriate. The change addressed a weakness in remote access control without saying that every part of the system had been fixed.
| Change | When | Source |
| Chief Information Security Officer hired | October 2015 | OPC and OAIC |
| Deloitte security review, written policies, staff training | from October 2015 | OPC and OAIC |
| Second factor for VPN access | after the breach | OPC and OAIC |
| Full delete retention cut to 6 months | after the breach | OPC and OAIC |
| Security award and 100% discreet claim removed | after the breach | OPC and OAIC |
| Security program with third-party assessments | December 2016 order | FTC |
ALM also changed how it handled full-delete records. The retention period after a full delete was cut from 12 months to 6.
Regulators also said the company removed photos of full-delete users that had been left in a disposal folder and fixed the technical issue that had left them there.
Regulators required more formal obligations after the investigation. Canada accepted a compliance agreement, and Australia accepted an enforceable undertaking.
Those measures required “significant additional steps” from the company. The FTC order required a data-security program with third-party assessments, and it prohibited the misrepresentations alleged by the FTC.
The company also changed public claims on the site. It removed the “trusted security award” medal from the home page.
It also removed the “100% discreet service” claim. Those removals mattered because regulators had treated the claims as part of the privacy and security case.
Have I Been Pwned lists no later Ashley Madison breach. That is a breach-notification record, and it says nothing about current security.
None of the regulatory documents cited here is a current security audit, so this page cannot say how secure the site is now.
What Nobody Can Measure About the Leak
Some of the most repeated questions about the Ashley Madison breach have no defensible number attached to them. The leak produced records, press attention, lawsuits and public fear, but it did not produce an official count for every harm that followed.
There is no official count of extortion attempts, lost jobs, divorces or deaths tied to the breach. Reporting mentions deaths, but reporting references are not the same as a published official total, so our analysis gives no number for that category.
The size of the real, active user base is also unresolved. The 12,000 figure was withdrawn, and the site counter counted sign-ups, which means it cannot be treated as a confirmed count of people who were real, active and reachable through the service.
Attribution is another blank space in the record. Krebs on Security reported that no one has been charged, as of July 2022, so this section does not assign the breach to a named person or a proven criminal defendant.
The settlement record leaves another number out. The court order does not publish an average payment for each class member, and claims were still open when the order was written.
A settlement headline can describe a fund without telling us what a typical claimant received.
We also draw a firm editorial line around identity. We do not name anyone who appeared in the data, and we do not link to the data.
For this article, the measurable story is limited to records, filings and published findings.
Most affairs come to light in ordinary ways, not through leaks. Our data on how cheaters get caught shows which ones.
Methodology and Sources
This section explains how we sourced the figures on this page and where we drew the line. We used primary documents first, then used secondary reporting only for findings that those documents did not contain.
The primary record starts with the joint report of the Office of the Privacy Commissioner of Canada and the Office of the Australian Information Commissioner, PIPEDA Report of Findings #2016-005, 2016. We also used the FTC press release and case record dated December 14, 2016, and the final approval order in MDL 2669 from the US District Court for the Eastern District of Missouri, 2017.
For breach comparisons, we read Have I Been Pwned breach records from its public API. Our classification of the 94 sensitive breaches into dating, hookup, or affair sites was done by hand from each entry’s own description, and we kept only verified entries that are not flagged as fabricated.
For the site’s own public membership claims, we used Internet Archive snapshots of ashleymadison.com, monthly from 2014 to 2017 and yearly after. Snapshots without a counter were skipped, never estimated, so the counter’s monthly pace is based only on saved pages that showed a counter.
Secondary sources were used in narrow places. Ars Technica was used for the password cracking findings, Gizmodo was used for bot account findings and the withdrawn 12,000 figure, and Krebs on Security was used for the reward and the absence of charges.
When a figure is our own calculation, the article labels it that way. Those calculations are the 14.4% gap, the 9.5% share of the FTC judgment, 4.6 cents per account, 13.3 claims per 100,000 American users, and the counter’s monthly pace.
We left out names of anyone in the data, any way to search it, and any count of deaths or extortion. Those omissions are intentional because no official body ever published such a count, and this article does not need identifying details to explain the numbers.
Ashley Madison still operates, and its homepage now claims 91 million members who joined since 2002, a figure attributed to the company itself. Anyone considering the site today should read what it costs and how its privacy settings work before signing up, then decide with those details in view.
