Ashley Madison, an extramarital affairs dating platform operated by Toronto-based Ruby Corp. (then called Avid Life Media), was breached in July 2015 by a hacker collective calling itself The Impact Team. The attackers exploited security misconfigurations, including hardcoded credentials in the site's source code and the use of weak MD5 password hashing alongside stronger methods, allowing them to move through internal systems and extract more than 60 gigabytes of data. When the company refused their demand to shut down the platform, the attackers released the data publicly. Approximately 32 to 38 million user records were exposed. The exposed data included real names, home addresses, email addresses, phone numbers, dates of birth, sexual orientation, payment histories, security questions and answers, and detailed website activity. Because Ashley Madison was built around the premise of discretion for people seeking affairs, the combination of real identity and behavioral data was exceptionally sensitive. Affected individuals faced targeted extortion attempts, public exposure of private conduct, and severe personal consequences. Multiple suicides were documented and directly linked to the breach. Canadian and Australian regulators launched formal investigations. A CAD $578 million class action lawsuit was filed against the company. The U.S. Federal Trade Commission reached a settlement with Avid Life Media in 2016 that required the company to undergo independent security audits for 20 years. The company was also found to have operated fake female profiles to drive male user engagement. For anyone affected by this breach: do not pay extortion demands, as payment rarely stops further contact and may invite escalation. If you are in crisis, please contact the 988 Suicide and Crisis Lifeline by calling or texting 988.

Discreet affairs platforms collect highly sensitive account data, profile details, messages, sexual-interest signals, payment-adjacent records, and relationship-intent activity tied to extramarital behavior.

The 2015 breach broke something the company couldn't fully repair. Avid Life Media rebranded as Ruby Corp. in 2016. The old name was too heavy to carry. Leadership turned over. The platform kept running. By 2025, the company describes its membership as growing. It says little else publicly.