14 DAY TRIAL // In an interview with Motherboard, The Impact Team, the hacking group that broke into the Ashley Madison dating site has revealed it still has 300GB of data that it still hasn't released.
When the Ashley Madison hack happened in July, The Impact Team announced they would not release anything if the site were shut down.
While this hasn't obviously happened, a couple of days ago, the hackers released 10GB of data containing customer details, followed by another 20GB of information containing internal emails and some of the site's source code.
This leak has had serious impact on the lives of many people with accounts on the site, and even some celebrities like Josh Duggar and Sam Rader.
Ashley Madison admins used Pass1234 as their password
Now, answering questions from a Motherboard writer, The Impact Team reveals that not only did the Ashley Madison portal have no security measures in place, the admins were stupid enough to use a simple pass phrase for their servers' root: " Motherboard: What was their security like? The Impact Team: Bad. [...] Only thing was segmented network. You could use Pass1234 from the internet to VPN to root on all servers."
This allowed the hackers to gain full control over all the servers, internal and external, letting them quietly download customer data, private conversations, user photos, credit card details, financial records, the site's source code, documentation, and internal emails exchanged by Avid Life Media, the company that ran the Ashley Madison site.
“Nobody was watching. No security.”
All of this data was stolen during the past years, and the hackers made sure to amount to a considerable database before going public with what they've found.
While almost 30GB of data was already put online, the group also made sure to keep 300GB more as a backup, just in case Avid Life Media won't heed their initial request to shut down.
Asked what their motivation for the hack was, The Impact Team explained, "We watched Ashley Madison signups growing and human trafficking on the sites."
This places the group in the category of hacktivists and not blackmailers, and their future hacking plans reveal that they are interested in righting some of the society's wrongs: "Not just sites. Any companies that make 100s of millions profiting off pain of others, secrets, and lies. Maybe corrupt politicians."