Opening up his Yahoo e-mail, John R. couldn’t help but be startled by the subject line of a message declaring: “You got busted.”
The 35-year-old, who works in the science field and asked that only his first name be published for personal and professional reasons, immediately clicked on the bait.
“Unfortunately your data was leaked in the recent hacking of Ashley Madison and I know [sic] have your information,” said the message.
“I have also used your user profile to find your Facebook page, using this I can now message all of your friends and family members,” it continued.
The poorly spelled extortion letter then demanded 2 bitcoin (worth approximately $500 when John received the e-mail in September) to be paid within three days. Otherwise, according to the sender, John’s friends and family would be automatically informed of his Ashley Madison membership.
Such e-mails have shown up in the inboxes of the estimated 37 million Ashley Madison users whose information was breached after a high-profile hack of the site in August. Ashley Madison is infamous for providing unfaithful spouses a platform to find illicit trysts.
Software-security expert Johannes Ullrich, Ph.D., dean of research for SANS Technology Institute in Jacksonville, Fla., believes the extortionists are unlikely to be part of the hacking group Impact Team, which shook down Ashley Madison.
“They used spambot techniques, which are favorites of the Russian mob and Nigerian scammers,” Ullrich says, adding it’s unlikely they would follow through with their threats.
“It would be too much trouble for them, and there is a risk they could be traced,” he says.
John, who had signed up for the infidelity Web site in the fall of 2013 for $350 when he and his wife of six years “could barely stand in the same room without arguing,” maintains his trysts never went offline.
“I didn’t meet with any of them in person but I was tempted,” says the God-fearing Missouri native, who nevertheless had an online “emotional affair” with one woman, with whom he exchanged sexy photos. He deleted his account in September 2014 after deciding to fix his marriage.
When that mending process was threatened by the blackmailers a year later, he was reassured by Status Labs, which advised him to not make any bitcoin transactions and to take the precaution of making his list of Facebook friends private.
Says Status Labs president Darius Fisher: “It’s simple to switch your privacy settings, but it’s important to remember that these extortionists, like all scammers and spammers, are playing a numbers game.
“If they scare even one or two people into paying up, it’s a big payday for them.”