Ashley Madison Data Breach: What Was Exposed
The 2015 leak exposed details of about 36 million accounts. Years later, criminals were still sending extortion emails using the data.
By Siddharth ShankarUpdated October 19, 2026In July 2015 the owner of Ashley Madison found unusual database activity, and an attacker published the data in August 2015. Regulators said it covered about 36 million user accounts, with profile details, email addresses, hashed passwords and, for some, billing names and addresses. Extortion emails using the data appeared years later. Never pay, check your exposure and change any password you reused.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
The Ashley Madison breach is one of the best-known data leaks because of how personal the data was. It also shows how a breach can keep hurting people years after the headlines fade.
What happened
The joint investigation by the Privacy Commissioner of Canada and the Australian Privacy Commissioner says the company behind the site, Avid Life Media, detected unusual database activity on July 12, 2015. The attacker, calling itself The Impact Team, published data on August 18 and 20, 2015. The published files included details of approximately 36 million user accounts.
What data was exposed
- Profile details: user name, postal code, relationship status, gender, height, weight, body type, ethnicity, date of birth and optional free-text fields.
- Account details: email addresses, security questions and answers, and hashed passwords.
- Billing details for some users: real names, billing addresses and the last four digits of a credit card. The company said full card numbers were generally not stored.
The investigators said they could not rule out access to other data such as photos and user messages.
The paid delete problem
Users could pay for a full delete. The investigation found that profiles became inaccessible within 24 to 48 hours, but the company kept the data for a further 12 months, later reduced to six. It also found the company kept data from deactivated and inactive accounts indefinitely, which it ruled a breach of privacy law. The lesson is that closing an account does not always erase the data behind it.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
The extortion emails
In early February 2020, nearly five years later, Threatpost reported that hundreds of people received emails threatening to expose their Ashley Madison accounts to family and friends unless they paid. The emails included personal details from the leak, such as addresses and dates of birth. The payment demand sat in a password-protected PDF with instructions and a QR code. The sample asked for about 0.1188 bitcoin, roughly $1,059, within six days.
What to do if you are affected or targeted
1Do not pay
Paying does not make a threat go away, and the sender can ask again. Report the message and keep a copy.
2Do not open attachments
The payment instructions arrive in files you should not need to open.
3Change reused passwords
If you ever used the same password on another site, change it. Use a password manager and turn on two-step verification.
4Check what else is exposed
Run the free check on this page to see which breaches include your email address.
5Talk to someone you trust
These scams work through shame. Telling a friend, a counsellor or the police takes away their power.
Lessons for any account you close
Before you give a service your data, check how long it keeps information after you delete. After you delete an account, ask for confirmation in writing. Our guide to the right to erasure explains how to ask.
Why old breaches still matter
Dates of birth, addresses and answers to security questions do not change. See should you worry about an old data breach and what each type of breached data means.
Sources
- Office of the Privacy Commissioner of Canada: PIPEDA Report of Findings #2016-005 (dates, about 36 million accounts, data types, paid delete, retention findings)
- Threatpost: Ashley Madison breach extortion scam targets hundreds (2020 extortion emails, PDF with QR code, 0.1188 bitcoin, six-day deadline)
Frequently asked questions
How many accounts were in the Ashley Madison breach?
The Canadian and Australian privacy commissioners said the published files included details of approximately 36 million user accounts.
Were passwords exposed?
The investigation said account data included hashed passwords, along with email addresses and security questions and answers.
Were credit card numbers leaked?
Billing data for some users included names, billing addresses and the last four digits of a card. The company said full card numbers were generally not stored.
Did paying for a full delete remove my data?
The investigation found that data was kept for a further period after a paid delete, first 12 months and later six months.
What should I do if I get an Ashley Madison extortion email?
Do not pay, do not open attachments and report the message. Change any reused passwords and check your email against known breaches.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.