On Tuesday 18 August 2015 a compressed archive of about 9.7 gigabytes appeared on a Tor hidden service, signed and prefaced by a text file headed Time's Up. It held the customer database of AshleyMadison.com, the Toronto infidelity site whose parent company, Avid Life Media, had been given a month to close it. The group calling itself the Impact Team had claimed the intrusion on 19 July; publication came thirty days later, and the two dates should not be run together. Researchers who checked the records against their own found them genuine, though the site's founding chief technology officer, Raja Bhatia, brought back to consult after the July claim, had spent weeks telling journalists that the dumps circulating were overwhelmingly fake. The company's statement did not dispute the contents. This was not hacktivism, it said, but an act of criminality against individual members.
What the archive held mattered more than its size. Alongside names, addresses, telephone and email addresses and seven years of credit-card transactions — roughly 32 million account records by the day's count, a figure the Federal Trade Commission would later state as 36 million profiles — sat the remains of accounts their owners had paid to erase. Ashley Madison sold a Full Delete option for nineteen dollars; contemporaneous reporting put its 2014 revenue at about $1.7 million from some ninety thousand buyers. The dump showed what the money bought: a handful of fields overwritten with a paid_delete marker, and the rest — city, date of birth, height, weight, stated preferences — still sitting there, beside a purchase record carrying the real name and billing address that had paid for the deletion.
The second archive came on Thursday 20 August, twice the size of the first and mostly internal: source code and years of company mail, including a file named noel.biderman.mail.7z. Hey Noel, the note read, you can admit it's real now. The extortion began next morning. A mail administrator, Rick Romero, watched messages arrive demanding exactly 1.0000001 bitcoin — about $225 — within seven days, the trailing decimal serving as a payment identifier; unfortunately, they opened, your data was leaked in the recent hacking of Ashley Madison and I now have your information. On 24 August, Toronto Police Staff Superintendent Bryce Evans told a press conference that the force was investigating two unconfirmed reports of suicide associated with the leak, alongside reports of hate crimes, and announced that Avid Life Media was offering a reward of $500,000.
Analysts working through the records found what the site's members had not. Gizmodo's first pass reported that fewer than one per cent of the female profiles showed regular use — a count it later corrected as a partial misreading of the fields — but the raw account totals held: around eighty-four per cent of all profiles were male; the Commission would later charge that the company had lured customers, nineteen million of them American, with fabricated female profiles until August 2014. Noel Biderman left Avid Life Media on 28 August. In December 2016 the operators paid about $1.6 million to the FTC and to thirteen states and the District of Columbia, on a far larger judgment suspended for inability to pay; in July 2017 the renamed Ruby Corp settled the consumer class action for $11.2 million, refunding the nineteen dollars. Nobody has ever been charged. The reward was never claimed.
Forty-six million dollars, by email
Ubiquiti Networks, a networking hardware maker with a subsidiary incorporated in Hong Kong, told the Securities and Exchange Commission in a Form 8-K filed on 6 August 2015 that it had been the victim of criminal fraud involving employee impersonation and fraudulent requests from an outside entity targeting the company's finance department. The transfers aggregated $46.7 million and went to overseas accounts held by third parties. The company said it had become aware on 5 June, had recovered $8.1 million, expected a further $6.8 million held under injunction, and was pursuing the balance; it booked a charge of $39.1 million and said its investigation had uncovered no evidence that its own systems were penetrated. Nothing had been hacked but a habit. On 27 August the FBI put the cost of business email compromise at $1.2 billion worldwide between October 2013 and August 2015, across more than seven thousand American companies, and its defensive advice singled out the lookalike domain — an address a hyphen or a single character away from the real one.
Reading the news before it was news
On 11 August the Securities and Exchange Commission announced fraud charges against thirty-two defendants over a scheme to trade on corporate earnings stolen before publication; the complaint had been filed under seal in Newark the previous day. Two Ukrainians, Ivan Turchynov and Oleksandr Ieremenko, were alleged to have spent five years inside newswire services — Business Wire, Marketwired and PR Newswire, in contemporaneous reporting — posing as employees and customers, taking hundreds of releases under embargo, and recruiting traders with a video that demonstrated the access. Alleged profits exceeded $100 million, and prosecutors in New Jersey and the Eastern District of New York brought parallel criminal charges. Elsewhere: Carphone Warehouse found an intrusion on 5 August and told customers three days later that up to 2.4 million records and 90,000 encrypted card details might have been taken; the IRS said on 17 August that its Get Transcript compromise reached about 334,000 accounts, three times its May estimate; and on 14 August Reuters reported former employees' claims that Kaspersky Lab had seeded false positives to damage rivals — accusations the company called meritless and simply false.
Eight hundred and fifty-seven, then fewer
On 31 July 2015 the Department of Telecommunications ordered internet service providers to block 857 pornographic websites, citing section 79(3)(b) of the Information Technology Act, 2000 and the decency and morality grounds of Article 19(2) of the Constitution. The order emerged from the long-running Kamlesh Vaswani petition, in which the Supreme Court had on 8 July declined to order interim blocking, observing that it could not dictate what an adult watched in private. The list did not survive contact with the public: among the blocked domains were sites carrying jokes and memes. On 4 August the minister for communications and information technology, Ravi Shankar Prasad, said sites without child sexual abuse material would be unblocked and that the government remained committed to freedom of communication on the internet.
Two smaller stories sat beneath it. In June a group calling itself TeamUnknown had posted on Reddit claiming access to the taxi aggregator Ola's database, including card transaction details and unused voucher codes; Ola said the material came from a staging environment on a separate network holding only dummy values for internal testing, and the group disputed that account. The claim belongs to June, not August. What August produced was duller: a customer, Swapnil Midha, spent a day and a night receiving booking confirmations meant for other passengers — names, telephone numbers, addresses — and heard nothing for about three weeks until the company replied on 30 August that the fault, a driver's number wrongly entered, was fixed. And on 11 August the Supreme Court held that Aadhaar could not be made mandatory and confined its use to the public distribution system and LPG, an order widened on 15 October.
M, an assistant that came with trainers
Facebook announced M on 26 August 2015, an assistant living inside Messenger, introduced by David Marcus, the company's vice-president of messaging products. It would book a restaurant, order a gift, chase a refund — things the assistants of the day could only look up — because behind the software sat people. Contract staff called M trainers finished whatever the model could not, the premise being that it would learn from them until they were no longer needed. M began with a few hundred testers in the San Francisco Bay Area, never left private beta, and closed on 19 January 2018. Earlier in the month, on 6 August, IBM agreed to buy Merge Healthcare for about $1 billion, or $7.13 a share, to give Watson medical images to read — the third and largest health acquisition since the Watson Health unit opened that April, and the unit was sold to private equity in 2022. On 10 August Larry Page and Sergey Brin announced Alphabet, the holding company DeepMind has reported into ever since.
Selling Veritas, and firmware that reinstalled itself
On 11 August 2015 Symantec agreed to sell Veritas, the storage and information-management business it had acquired a decade earlier, to an investor group led by the Carlyle Group with Singapore's GIC, for about $8 billion in cash. The board approved it unanimously, the company expected roughly $6.3 billion in net cash proceeds, and the rationale was plain — Symantec would be a security company and nothing else. The price was cut to about $7.4 billion the following January and the sale closed on 29 January 2016. On the same day as the announcement, Lenovo published the full list of machines that had shipped with its Service Engine — firmware that used Microsoft's Windows Platform Binary Table to write its own updater into Windows at boot, surviving deletion and a clean reinstall. Roel Schouwenberg had found a buffer overflow in it that April; Lenovo dropped it from new machines in June and released removal tools on 31 July. An engine that scans a disk sits a layer above whatever writes to it.
⏳ Time capsule — August 2015
- On 3 August a framework agreement was signed in New Delhi between the Government of India and the NSCN-IM, in the presence of Prime Minister Narendra Modi, towards ending the country's longest-running insurgency; its wording is still argued over a decade later.
- Late on 12 August two explosions tore through a hazardous-goods warehouse run by Ruihai Logistics at the Port of Tianjin in China. The official account records 173 deaths, 104 of them firefighters, and 798 injured; investigators traced the ignition to nitrocellulose and found around 700 tonnes of sodium cyanide stored on the site.
- On 14 August the United States reopened its embassy in Havana, 54 years after the mission closed. Secretary of State John Kerry presided, and three Marines who had lowered the flag in 1961 — Larry C. Morris, Mike East and Jim Tracy — presented the new one.
- On 23 August Usain Bolt won the 100 metres final at the World Championships in Beijing in 9.79 seconds, one hundredth of a second ahead of Justin Gatlin, who lost his balance in the last strides.
What a deletion is worth
A decade on, August 2015 is remembered less for the intrusion than for the sentence it disproved. Ashley Madison's Full Delete was not a claim about security; it was a claim about records, and the archive published on 18 August carried the refutation in its own columns. Nobody was ever charged for taking it, and the half-million-dollar reward went unclaimed. What followed was regulatory rather than criminal: the operators settled with the Federal Trade Commission and thirteen states in December 2016, and the renamed Ruby Corp settled the consumer class action for $11.2 million in July 2017, returning nineteen dollars apiece to the people who had bought the erasure. The right to have data deleted, and the duty to actually delete it, is now written into statute from Europe to India's DPDP Act.
The month's other lessons aged into infrastructure. Business email compromise, which moved $46.7 million out of Ubiquiti and required no malware at all, became the most expensive category of crime the FBI counts, and the $1.2 billion announced on 27 August 2015 now reads as an opening figure. Oleksandr Ieremenko, charged that August over the newswires, was charged again on 15 January 2019 over earnings files taken from the SEC's own EDGAR system — the same trade, one step closer to the source. Carphone Warehouse's £400,000 penalty in 2018 was near the ceiling of the British regime then in force and would be a rounding error under the one that replaced it. And the habit of counting the hours after an incident, rather than the months, hardened in India into the six-hour rule.