An anonymous Ashley Madison user has filed a potential class action lawsuit against parent company Avid Life Media, alleging that the company failed to take "necessary and reasonable precautions" to prevent hackers from breaching the company's files and releasing millions of user profiles. "John Doe," who filed the suit in a California district court late last week, claims to have signed up for the cheating-focused Ashley Madison dating service in 2012. He's attempting to file on behalf of any US resident who signed up for the service and had data leaked, accusing Ashley Madison of negligence and inflicting emotional distress among other charges. The suit also includes allegations based on local California laws, including invasion of privacy and violating the state's rules about customer records.
The charges hinge on a few basic premises. Doe argues that Avid Life Media should have implemented better security around customers' records, which included details like their dates of birth, location, and physical attributes. "This massive data breach could have been prevented had [Avid Life Media] taken the necessary and reasonable precautions to protect its users’ information by, for example, encrypting the data entrusted to it by its users on a database level," reads the suit. (Passwords were encrypted, though some have apparently been cracked.) The suit references the "recent rise of massive security breaches on the internet" to argue that Avid Life Media should have known the risks — while not mentioned by name, Sony and Home Depot both suffered major security compromises in late 2014. It also says that Avid Life Media didn't inform Ashley Madison users of the hack in a timely fashion, and that users who had previously paid for a full "scrub" of their profile didn't actually get the information removed. Meanwhile, profile information for over 32 million accounts was posted online, revealing potential infidelity, sexual fetishes, and other sensitive information. Yesterday, Toronto police said they had unconfirmed reports of two suicides linked to the leaked profile information.
Multiple American lawsuits have been threatened since the Ashley Madison hack was first revealed, though it's hard to say which charges might stick. A pair of Canadian law firms also announced a similar class action suit last week, seeking CA$760 million (US$571 million) in damages. No suit so far has been granted class action status by a court. The full fallout of the hack itself is still unknown, and police are still investigating the group allegedly behind it, known as Impact Team.
