Who Hacked Ashley Madison?

[InfoSec News <alerts () infosecnews org>]

http://krebsonsecurity.com/2015/08/who-hacked-ashley-madison/

By Brian Krebs
Krebs on Security
August 26. 2015

AshleyMadison.com, a site that helps married people cheat and whose slogan 
is “Life is Short, have an Affair,” recently put up a half million 
(Canadian) dollar bounty for information leading to the arrest and 
prosecution of the Impact Team — the name chosen by the hacker(s) who 
recently leaked data on more than 30 million Ashley Madison users. Here is 
the first of likely several posts examining individuals who appear to be 
closely connected to this attack.

It was just past midnight on July 20, a few hours after I’d published an 
exclusive story about hackers breaking into AshleyMadison.com. I was 
getting ready to turn in for the evening when I spotted a re-tweet from a 
Twitter user named Thadeus Zu (@deuszu) who’d just posted a link to the 
same cache of data that had been confidentially shared with me by the 
Impact Team via the contact form on my site just hours earlier: It was a 
link to the proprietary source code for Ashley Madison’s service.

Initially, that tweet startled me because I couldn’t find any other sites 
online that were actually linking to that source code cache. I began 
looking through his past tweets and noticed some interesting messages, but 
soon enough other news events took precedence and I forgot about the 
tweet.

I revisited Zu’s tweet stream again this week after watching a press 
conference held by the Toronto Police (where Avid Life Media, the parent 
company of Ashley Madison, is based). The Toronto cops mostly recapped the 
timeline of known events in the hack, but they did add one new wrinkle: 
They said Avid Life employees first learned about the breach on July 12 
(seven days before my initial story) when they came into work, turned on 
their computers and saw a threatening message from the Impact Team 
accompanied by the anthem “Thunderstruck” by Australian rock band AC/DC 
playing in the background.

[...]

--
Evident.io - Continuous Cloud Security for AWS.
Identify and mitigate risks in 5 minutes or less.
Sign up for a free trial @ https://evident.io/