A hacker group calling itself The Impact Team broke into a Canadian dating website, threatened to publish its user database, and then did exactly that. The details of around 36 million accounts were posted online in August 2015. Yet the case that matters for Australian businesses is not just the scale of the leak. It is that the Office of the Australian Information Commissioner (OAIC) investigated the company behind the site, found it in breach of Australian privacy law, and extracted a binding commitment to overhaul how it handled personal information. All of this happened to a business with no office, no employees and no physical presence in Australia.
The breach and the joint investigation
Avid Life Media Inc (ALM) was a Canadian company that ran Ashley Madison, a website marketed at people seeking an extramarital affair, along with three other adult dating sites. Ashley Madison was its largest product, holding around 36 million user profiles at the time of the breach. ALM had no presence in Australia, but its sites had users in over 50 countries, including hundreds of thousands in Australia, and it advertised directly to Australian users.
On 12 July 2015, ALM's IT staff noticed unusual behaviour in its database management system that indicated unauthorised access. The next day a message appeared on staff computers from a group calling itself The Impact Team. It claimed to have hacked ALM and demanded that Ashley Madison and a sister site be shut down, or the stolen data would be published. ALM refused, and on 18 and 20 August 2015 the group published a large cache of files online. The publication included database files covering approximately 36 million Ashley Madison user accounts, together with emails, source code and other documents taken from ALM's corporate network.
The data was deeply personal. Published profile information included physical descriptions, relationship status, date of birth, and free-text fields where users had recorded intimate desires and preferences. Account information included email addresses, security questions and answers, and hashed passwords, and billing records for a subset of users included real names and billing addresses. ALM's own forensic analysis could not establish the full extent of what the hackers took, in part because they had escalated their access to administrator level and deleted logs. ALM told affected users that any information they had provided through the website, including photos and communications, may have been acquired.
In August 2016 the OAIC and the Office of the Privacy Commissioner of Canada released a joint investigation report into ALM's handling of personal information. The report is the authoritative account of the breach, the state of ALM's security at the time, and why the regulators concluded that ALM had broken the law.
Why an Australian regulator could act at all
The legal framework that made this possible is important for any business that collects data from people in Australia, wherever the business itself is located.
The Privacy Act 1988 (Cth) (the Act) regulates entities that are "organisations" under s 6C. A small business operator is generally exempt, but the exemption only applies to a business whose annual turnover is $3 million or less (s 6D). ALM's revenue was in excess of US$100 million in 2014, so it was an organisation well outside the small business exemption.
The Act also reaches beyond Australia's borders. Section 5B(1A) extends the Act to acts done or practices engaged in outside Australia by an organisation that has an "Australian link". An organisation has such a link if, among other things, it carries on business in Australia and collects or holds personal information in Australia (s 5B(3)). ALM had no office here, but it marketed to Australian residents, ran pages targeted at Australian users, and collected personal information from people physically present in Australia when they signed up. The OAIC was satisfied that ALM had an Australian link, and so under s 15 of the Act it was prohibited from doing anything that breached an Australian Privacy Principle (APP).
The practical consequence: if your business collects personal information from people in Australia, the APPs apply to that handling no matter where your servers, your staff or your parent company sit. The same logic that captured ALM would capture an Australian business's own offshore service providers, and it is why data-handling arrangements with overseas contractors deserve close attention.
What the regulators found
The investigation examined ALM's security safeguards, its retention of account data, the accuracy of the email addresses it collected, and its transparency with users. The findings on each point translate directly into obligations that Australian businesses carry.
Security safeguards must be reasonable in the circumstances
APP 11.1 requires an APP entity to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The report is careful to say that a security compromise does not, by itself, mean the law was broken. The question is whether the safeguards in place were reasonable in the circumstances.
For ALM, the circumstances demanded a great deal. It held sensitive information, including information revealing users' sexual practices and preferences, which falls within the definition of "sensitive information" in s 6 of the Act. The foreseeable harm to users if the data became public was severe, including reputational damage and even extortion, which the regulators confirmed had occurred after the leak. On top of that, ALM's front page promised users complete confidentiality, and displayed a fabricated "trusted security award", setting expectations of a high standard of security.
Measured against that context, the safeguards failed. ALM had no documented information security policies or practices, no explicit risk management process, and no adequate security training for staff. Only about 25% of staff had received the recently developed training at the time of the breach. Remote access to the network was protected by a single factor of authentication, with no multi-factor authentication for administrative access. There was no intrusion detection system, no security information and event management system, and no data loss prevention monitoring. Passwords and encryption keys were stored poorly in places, and a shared secret used for VPN access was available on a staff Google Drive.
The report concluded that ALM contravened APP 1.2, which requires entities to implement practices, procedures and systems that ensure APP compliance, and APP 11.1, because the steps it took to protect the information were not reasonable in the circumstances. The missing element was not any single control. It was the absence of a coherent, documented governance framework that would have forced ALM to assess its risks, choose controls to meet them, and verify that they were being implemented.
Data retention needs a purpose and an end date
APP 11.2 requires an APP entity to take reasonable steps to destroy or de-identify personal information once it no longer needs the information for any purpose for which it may be used or disclosed under the APPs.
Users of Ashley Madison could close their accounts in two ways. A basic deactivation was free and reversible, but ALM retained the associated personal information indefinitely, including for accounts that stayed inactive for a long period. ALM's stated reason, that users might reactivate their accounts, was not supported by its own data: of users who did reactivate, 99.9% did so within 29 days. The report found that indefinite retention of deactivated and inactive accounts contravened APP 11.2.
The contrast with the second option shows the line the regulators drew. A "full delete" required payment of a fee, and ALM retained the information for a further 12 months after deletion to defend against fraudulent credit card chargebacks. The report accepted this as a legitimate secondary use. Retention to prevent fraud fell within the permitted general situations in s 16A of the Act, which allow use or disclosure for a secondary purpose where it is reasonably necessary to take action against suspected unlawful activity. What made it lawful was that the retention period was tied to a defined purpose and limited to what was reasonably necessary: most chargebacks occurred within six months, so a 12-month window was defensible, while indefinite retention was not.
Accuracy obligations extend to people who never dealt with you
APP 10 requires an APP entity to take reasonable steps to ensure the personal information it collects is accurate, up to date and complete, and that information it uses or discloses is accurate having regard to the purpose of the use or disclosure.
ALM required every user to supply an email address to create an account, but deliberately did not verify the addresses, saying this protected user anonymity. The welcome email's footer told recipients who had received it in error that they could unsubscribe or delete the account, with the delete option requiring payment. When the database was published, it included email addresses belonging to people who had never used Ashley Madison, falsely associating them with the site.
The regulators found this breached APP 10. Two points matter beyond the dating context. First, ALM argued that its accuracy obligations only protected people who dealt with it directly, not third parties whose information was submitted by someone else. The commissioners rejected that, holding that the accuracy provisions apply to all individuals whose personal information an organisation collects, uses or discloses. Second, the welcome email footer was held to be an insufficient response, because it put the burden on an innocent recipient to act on an unsolicited email. Reasonable options, the report said, included making the email field optional or introducing automated verification.
The outcome: an enforceable undertaking
The Acting Australian Information Commissioner accepted an enforceable undertaking from ALM under s 33E of the Act. ALM committed to conduct a comprehensive review of its protections, to build, document and implement an information security framework, to train all staff with network access, to stop retaining deactivated and inactive accounts indefinitely and instead adopt and publish retention periods based on usage patterns, and to change its account creation process so that users could join without an email address or with verified addresses. The undertaking was enforceable, and it was published. For a company that had marketed discretion as its core promise, the public findings were themselves a substantial consequence.
What your business should take from this case
The Ashley Madison investigation is often treated as a story about one unusual business. The OAIC's findings are more useful than that. They set out, in one document, how the regulator applies the reasonableness test in APP 11, how it treats retention under APP 11.2, and how far accuracy obligations reach under APP 10. For a business that holds customer data, that is the practical value of the report:
- Document your security governance: Have a written information security policy, a risk assessment process that is actually used and reviewed, and evidence that staff are trained. The report treated the absence of these as the core failure, because without them ALM had no way of assuring itself that its security matched its risks.
- Match your controls to your data: Multi-factor authentication for remote access, monitoring for unusual access, and a disposal process for data you no longer need are all steps the report treated as basic for an organisation holding significant or sensitive personal information.
- Give every retained data set a purpose and a time limit: Indefinite retention was the breach; retention for a defined fraud-prevention period was acceptable. Review what you hold and why, and write the answers down.
- Check the accuracy of data you collect: If your systems let people enter information about others, or you hold data that could misidentify people, the accuracy obligations apply to those third parties too.
- Do not promise more security than you deliver: The report noted that ALM's marketing claims about discretion set the benchmark against which its safeguards were judged.
Since the report was published, the Privacy Act has become a sharper enforcement tool. A serious interference with privacy is now a civil penalty provision under s 13G of the Act, and since 2018 the Notifiable Data Breaches scheme has required entities to notify the OAIC and affected individuals when an eligible data breach occurs. The stakes attached to the failures the report identified are higher now than they were in 2016.
Where a privacy lawyer helps
A privacy lawyer's role in this area is largely preventive. In the position ALM found itself, professional help would have started long before the breach: conducting a privacy impact assessment to identify the risks attached to the business's data holdings, building the documented security framework and risk management process that APP 1.2 and APP 11.1 require, and drafting a privacy policy that reflects the business's actual practices rather than its marketing.
Retention is another area where legal input pays for itself. A lawyer can help work out which retention periods are defensible under APP 11.2 and which are not, draft a retention and disposal schedule, and test whether proposed secondary uses, such as fraud prevention, fall within the permitted general situations in s 16A. That is precisely the analysis that separated the lawful 12-month retention from the unlawful indefinite retention in the Ashley Madison case.
A lawyer also helps a business prepare for the worst. Breach response planning, including the steps and notification triggers under the Notifiable Data Breaches scheme, and dealing with the OAIC if an investigation begins, are tasks where the difference between a well-run response and a poor one can be measured in penalties and reputation. An enforceable undertaking is a public document, and the OAIC can be expected to monitor compliance with it closely.
The lesson that survives the headlines
The single most important idea from the Ashley Madison investigation is that the law does not require a business to have perfect security. It requires a business to take steps that are reasonable in the circumstances, and to be able to show why those steps were the right ones for the data it holds. ALM had plenty of individual safeguards. What it lacked was the documented framework that would have forced it to work out whether those safeguards were the right ones, and to notice when they were not.
That distinction matters because it reframes the task. The question is not "have we installed enough security products?". The question is "what data do we hold, what would happen if it leaked, and what have we written down and implemented to prevent that?". If your business cannot answer those questions today, the Ashley Madison report is the explanation of why you should be able to.
For an Australian business, the case also carries a quieter warning. The regulator that investigated a Canadian company with no local presence did so because the company collected personal information from people in Australia. If your business handles the data of Australian customers, or passes it to providers overseas, the same reach applies to you. The reasonable steps test does not care where your servers are.