Was Ashley Madison really hacked?

Yes. In July 2015 a group called the Impact Team broke into the company's systems and, in August 2015, published data the FTC said affected 36 million users. Nobody had been charged as of 2022.

Is my old Ashley Madison data still out there?

If you had an account before mid-2015, assume the 2015 data is still circulating. Extortion emails referencing the breach were still showing up in 2020. Don't respond to them, and never pay.

How much did Ashley Madison pay the FTC?

The December 2016 settlement imposed an $8.75 million judgment, suspended once the operators paid $828,500 to the FTC and $828,500 to 13 states and DC, for $1.6 million in total.

What shows on my statement if I pay Ashley Madison?

The app's store listing says the charge appears as “AMDA” unless your card company or bank modifies it. Check the current descriptor at checkout before paying.

Is Victoria Milan safer than Ashley Madison?

We can't audit any company's servers, so we won't claim it's breach-proof. What we can say is that Victoria Milan's published privacy tools (photo blur and masks, private keys, panic button, auto log-out, no site name on statements) are the reason it's our #1.

Is Ashley Madison safe after the 2015 hack?

Updated October 12, 2026 · Match Parfait editorial team · How we rate

Short answer

Ashley Madison is a different company from the one hacked in 2015: it was renamed, it settled with the FTC and 13 states in 2016, and that order required a comprehensive data-security program with outside assessments. But the 2015 leak showed that a dating site can lose everything at once, so no affair site is safe enough to trust blindly. Limit what you hand over, whichever platform you pick.

See Victoria Milan

Affiliate disclosure: some links on this page pay us a commission if you sign up or buy, at no extra cost to you. It never changes our criteria. How we earn money.

01What happened in July and August 2015

On July 19, 2015, security journalist Brian Krebs reported that a group calling itself the Impact Team had broken into Avid Life Media, the Toronto company behind Ashley Madison. Their demand was blunt: take Ashley Madison and its sister site Established Men offline for good, or every customer record would be published.

The company didn't shut down. On August 18, 2015, the hackers posted links to roughly 60 GB of user data, followed by internal company files and executive emails. The FTC later described the breach as exposing the profile information of 36 million users worldwide.

The detail that made the hackers' point for them was a paid feature called “Full Delete.” Members paid $19 to have their profile erased. According to the FTC's complaint, the company kept that information anyway, and it ended up in the leak.

02What actually leaked

This wasn't just a list of email addresses. The FTC said users had been assured that details like date of birth, relationship status and sexual preferences were private and securely protected. Those are exactly the fields that make a leak from an affair site so damaging.

Profile data: usernames, profile descriptions, stated preferences and relationship status.
Payment records: Krebs reported the hackers had threatened to publish card transactions with real names and addresses, and said Full Delete purchase records were not removed.
Passwords: most were hashed with bcrypt, but in September 2015 a password-cracking group called CynoSure Prime said a coding flaw involving weaker MD5 hashes let it recover more than 11 million of them.
Company data: employee account details, internal server maps and years of executive email.

The lesson that matters for you today: anything you type into a dating profile, and anything tied to how you paid, should be treated as something that could one day become public.

03The extortion wave that followed

Within days, people in the leaked data started getting blackmail emails. Krebs reported on August 21, 2015 that one message demanded about $225 in bitcoin to keep a member's account from being revealed to a spouse. Toronto police urged victims not to pay and reported two unconfirmed suicides linked to the leak. The company offered a $500,000 reward for information on the attackers. As of Krebs's 2022 retrospective, nobody had been charged.

It didn't end in 2015. In early 2020, the email security firm Vade Secure flagged a new campaign aimed at people whose details appeared to come from the breach. The emails quoted details such as signup dates and profile interests, and hid a demand of roughly $1,000 in bitcoin inside a password-protected PDF to slip past spam filters. Trend Micro noted the senders may simply have been exploiting the breach's notoriety. Either way, the target was the same: people with something to hide.

If an email like that ever reaches you, don't reply and don't pay. Paying marks you as someone who pays.

04The 2016 FTC settlement and other cases

In December 2016 the operators, by then named Ruby Corp. and Ruby Life Inc., settled charges brought by the FTC and 13 states plus the District of Columbia. Here is what the regulators found and what the companies agreed to.

Issue	What regulators said or ordered
Security	No written information security policy, no reasonable access controls, inadequate staff training. Intruders got in several times between November 2014 and June 2015 without being detected.
Fake trust badge	The site displayed a “Trusted Security Award” the FTC said was made up.
Full Delete	Members paid $19 for deletion, but their data was kept.
Fake profiles	The FTC alleged the site used fake “engager” profiles of women to turn men into paying members.
Money	An $8.75 million judgment, suspended on payment of $828,500 to the FTC and $828,500 to the states: $1.6 million in total.
Going forward	A comprehensive data-security program with third-party assessments, and a ban on the alleged misrepresentations.

Canada's and Australia's privacy commissioners reached their own findings in August 2016, and a US class action in Missouri settled for $11.2 million in 2017.

05What has changed since

The brand survived. Avid Life Media became ruby in 2016, and the Ashley Madison app is now published by Ruby Life Inc. In February 2026 the company repositioned the site from “married dating” to “discreet dating,” with a new tagline, and its chief strategy officer told Fox News Digital that 57% of new members are single. That is the company's own figure, not an audited one.

On the privacy side, the app's store listing promotes private photo masking and discreet billing, and states that charges appear on statements as “AMDA” unless your bank changes the label. The FTC order also means an outside assessor has been looking at its security program. None of that makes a breach impossible. It means the obvious failures of 2015 are no longer allowed.

Our honest take: Ashley Madison today is not the reckless operation the FTC described in 2016. But the name now carries a permanent asterisk, and many readers would rather not be on that platform at all. That is a reasonable feeling, not paranoia.

06A privacy checklist for any affair site

These habits protect you on Ashley Madison, on Victoria Milan, or anywhere else. They assume the worst-case scenario, because 2015 proved it can happen.

Create a fresh email address used for nothing else, with no real name in it.
Use a unique password and turn on any two-step verification the email provider offers.
Leave out your employer, your town, your kids and anything a search engine could connect to you.
Use photos that don't appear anywhere else online, and blur or mask your face in public photos.
Read the billing descriptor before paying, and decide whether that line is safe on your statement.
Never send intimate photos with your face, tattoos or a recognizable room in them.
Delete old conversations you no longer need, and know how to close the account before you open it.
Treat any message demanding money “or else” as a scam: don't answer, keep the evidence, report it.

07If privacy is your priority, look at Victoria Milan

Victoria Milan is our editorial #1 for discreet dating, and privacy is the main reason. Its help center describes an “Anonymizer” tool that lets you blur your photos or add a mask, private photos that others must request with a “Private Key,” a panic button that switches the screen to YouTube, and an automatic log-out after inactivity. It also says the name VictoriaMilan never appears on your bank statement and that support only acts on requests sent from your registered email.

Two things to know before you join. The site is run by Nextlove Limited in Malta, with payments collected by a separate Hungarian company, so check your statement line after the first charge. And its terms say some computer-generated profiles exist, marked with a “virtual hottie” tag. We'd rather you hear that from us than discover it later. It's still the platform we'd point a privacy-minded reader to first.

No site can promise total anonymity. Pick the one that gives you the most control, then share as little as you can.

Questions

Was Ashley Madison really hacked?
Yes. In July 2015 a group called the Impact Team broke into the company's systems and, in August 2015, published data the FTC said affected 36 million users. Nobody had been charged as of 2022.
Is my old Ashley Madison data still out there?
If you had an account before mid-2015, assume the 2015 data is still circulating. Extortion emails referencing the breach were still showing up in 2020. Don't respond to them, and never pay.
How much did Ashley Madison pay the FTC?
The December 2016 settlement imposed an $8.75 million judgment, suspended once the operators paid $828,500 to the FTC and $828,500 to 13 states and DC, for $1.6 million in total.
What shows on my statement if I pay Ashley Madison?
The app's store listing says the charge appears as “AMDA” unless your card company or bank modifies it. Check the current descriptor at checkout before paying.
Is Victoria Milan safer than Ashley Madison?
We can't audit any company's servers, so we won't claim it's breach-proof. What we can say is that Victoria Milan's published privacy tools (photo blur and masks, private keys, panic button, auto log-out, no site name on statements) are the reason it's our #1.

See Victoria Milan

Affiliate disclosure: some links on this page pay us a commission if you sign up or buy, at no extra cost to you. It never changes our criteria. How we earn money.

Sources

Keep reading