Pierluigi Paganini August 23, 2015

The hackers behind that data breach of the Ashley Madison website have released another dump of 20 GB and experts are publishing their analysis on it.

The recent hack of the adultery website Ashley Madison is attracting the attention of the media, after the disclosure of a second dump of data the security experts started their analysis on the leaked information.

Today I decided to propose you an interesting point of view proposed by the marketwatch.com which published a post to highlight that hundreds of email addresses in the Ashley Madison data dump are in big banks’ domains. MarketWatch analyzed data provided by the popular security researcher Robert Graham, CEO of the Errata Security firm.

This news is not surprising for me, but evidently someone still believes that there is a substantial difference between users of the adultery website. The report correctly noted the wrong security posture of hundreds of bankers which used their work email addresses to register for Ashley Madison website.

Analysts from MarketWatch analyzed the email addresses and found at least 665 emails associated with major financial institutions.

Bankers aren’t the unique unwary users, according to the Hill the dump of the Ashley Madison data includes more than 15,000 government and military emails.

We have also to consider that the AshleyMadison.com doesn’t verify users’ email addresses in the sign in process, which means people can use fake emails or email accounts belonging to other individuals.

[Ashley Madison] “actively monitoring and investigating this situation to determine the validity of any information posted online and will continue to devote significant resources to this effort.” states Ashley Madison in a statement published on the adultery website.

Below the list of financial institutions searched by the MarketWatch:

Wells Fargo — @wellsfargo.com: 175
Bank of America — @bankofamerica.com: 76
Deutsche Bank — @db.com: 73
Citigroup — @citi.com: 51
Goldman Sachs — @gs.com: 45
PNC Bank — @pnc.com: 28
U.S. Bancorp — @usbank.com: 15
Bank of New York Mellon — @bnymellon.com: 14
J.P. Morgan Chase — @jpmchase.com: 9
Capital One — @capitalone.com: 4

“While we cannot speak to the veracity of the data, as a matter of company policy we require that team members use personal email addresses to conduct personal business,” Wells Fargo spokesman Ancel Martinez told MarketWatch.

At this point, there are two things to seriously consider, bankers are a privileged target of cyber criminals that could use this data to run further attacks in an attempt to steal sensitive data. Another disconcerting consideration to do is related to the use of corporate asset made by bankers and more in general by employees that could expose the company to risk of hack due to lack of awareness of principal cyber threats.

Let me close with another interesting data related to the Ashley Madison hack, a researcher has mapped all the users to a Google Maps view showing that the majority of them are from Europe and US.

The research also claims that 85% of the Ashley Madison users are males.

Pierluigi Paganini

(Security Affairs – Ashley Madison, data breach)