The parent company of infidelity dating website Ashley Madison was responsible for numerous violations of privacy laws at the time of a massive release of customer data in a cyber attack last year, privacy watchdogs in Australia and Canada have found.
The two countries launched an investigation after the 2015 breach of Avid Life Media's computer network, when hackers exposed the personal details of millions who signed up for the site with the slogan "Life is short. Have an affair."
More News Videos
Ashley Madison faces FTC probe
The Federal Trade Commission is investigating the parent company of the infidelity dating site Ashley Madison.
The probe found the Toronto-based company had inadequate safeguards in place, including poor password management and a fabricated security trustmark on the website's home page.
While the company did have some personal information protections in place, it fell short in implementing those measures, the report found. For instance, it said some passwords and encryption keys were stored as plain, identifiable text on the company's systems.
![Ashley Madison made up some of the security credentials displayed on its site.](/web/20161028214005im_/http://www.smh.com.au/content/dam/images/g/j/b/m/t/6/image.related.articleLeadwide.620x349.gqzk5w.png/1471991962273.jpg)
"The findings of our joint investigation reveal the risks to businesses when they do not have a dedicated risk management process in place to protect personal information," said Australian Privacy Commissioner Timothy Pilgrim in a release.
"This incident shows how that approach goes beyond 'IT issues' and must include training, policies, documentation, oversight and clear lines of authority for decisions about personal information security."
Avid Life Media, recently rebranded as Ruby Corp, has entered into agreements with authorities in both Australia and Canada to comply with investigators' recommendations, which are enforceable in court.
The company is also the target of a USÂ Federal Trade Commission investigation, Avid Life Media executives said in July.
The FTC's consumer protection unit investigates cases of deceptive advertising, including instances when consumers are told that their information is secure but then it is handled sloppily.
At the time of the breach, Ashley Madison's home page displayed various trustmarks suggesting a high level of security, including an icon labelled "trusted security award," the privacy watchdogs'Â report said. Company officials later admitted they had fabricated the trustmark and removed it.
The company also inappropriately retained some personal information after profiles had been deactivated or deleted by users and did not adequately ensure the accuracy of customer email addresses, the report said. This meant that some people who had never signed up for Ashley Madison were included in databases published online after the hack, it said.
Among the investigators' recommendations, Ruby will have until the end of the year to complete a review of the protections it has in place for the protection of personal information. The company has said that the review was a key priority and already underway.
Reuters, with Fairfax Media
0 comments
New User? Sign up