Leaked secrets as a weapon: Ashley Madison, a clinic, Medibank

A password can be changed. A bank card can be cancelled. A diagnosis, a photograph taken on a surgeon's table, or the fact that you once held an account on a particular website cannot be taken back once strangers have it. That is why a leak of intimate or medical data hurts in a way that a leaked shopping account does not, and why the criminals behind it so often move to the next step: they write to the people in the files.

This article follows three documented cases. In 2015, the customer records of the dating site Ashley Madison were published. In 2017, hackers stole photographs and records from a Lithuanian cosmetic surgery clinic and tried to sell them back to patients one by one. In 2022, a cyber attack on the Australian insurer Medibank put the health claims of millions of people on the dark web. Then we look at the research on stress after a breach, what to do if your own data has leaked, and what the companies holding it owed you.

If you are reading because a message has just arrived, take one breath first. You did nothing wrong by being a customer or a patient, and there are concrete steps further down. If it feels too heavy, the last section lists people you can talk to at any hour.

Why intimate and medical data is the most dangerous kind to lose

Most stolen data is valuable because it can be used for fraud. Intimate and medical data is different. Its value lies in what the victim will do to stop it being seen. A criminal does not need to open a credit line in your name when the threat of telling your family may be enough.

• It cannot be replaced. A new password takes minutes. A new medical history or a new set of private photographs does not exist.
• It carries stigma. Mental health care, addiction, reproductive health, sexual orientation and an affair are all subjects where other people attach shame, often unfairly.
• It leaves victims feeling they must explain themselves to everyone who might see the files, before anything has even happened.

Researchers have tried to measure this. A 2024 study in the Journal of Cybersecurity and Privacy surveyed 166 students and 359 members of the public about the worst data breach they had personally experienced. The authors scored breaches involving sexually explicit content, such as the Ashley Madison leak, and thefts of intimate photos and private messages as the most severe, and found that more invasive breaches were linked to higher stress scores.

Ashley Madison, 2015: when a customer list becomes a target list

Ashley Madison was a Toronto-based dating site for people seeking affairs. According to Toronto police, staff at its parent company, Avid Life Media, found a threatening message from a group calling itself the Impact Team on 12 July 2015. The hackers went public on 20 July. On 20 August they released the stolen data on a hidden website with a message that began "Time's up!", the Guardian reported.

The numbers vary by outlet: Reuters wrote of as many as 37 million users, the Guardian of about 33 million profiles, and the 2024 study of 32 million records. The study lists names, home addresses, email addresses, card transactions, private messages and, in its words, sexual preferences and fantasies.

Within days the harm moved from the database to individuals. At a press conference on 24 August, Toronto Police Acting Staff Superintendent Bryce Evans said people were trying to extort members by threatening to send evidence of their membership to friends, family or colleagues. He also warned of scams that claimed to erase names from the database for a fee, and of fake "hack checking" sites that sent malware to the emails of the curious. "Nobody is going to be able to erase that information," he said, because several sites had already downloaded the database.

Evans also said police had received two unconfirmed reports of suicides associated with the leak. No further detail was given, and this article gives none. A death is never explained by one event, and the confirmed facts are limited. What the statement shows is how seriously officers took the human stakes. "We're talking about families," Evans said. "We're talking about their children, we're talking about their wives, we're talking about their male partners." He said the nature of the site was "of no interest" to investigators.

Lithuania, 2017: a surgery clinic and photographs taken for medical reasons

Grožio Chirurgija is a cosmetic surgery clinic in Lithuania. In April 2017, the outlet 15min, in a report republished by the public broadcaster LRT, wrote that police in Kaunas had opened an investigation on 6 April into unlawful access to an information system, extortion and unlawful collection of private information, with a maximum penalty of up to ten years in prison.

The clinic's first statements were reassuring and wrong. According to 15min, a representative first said only names and addresses had leaked, and a surgeon insisted the before-and-after photographs could not have been stolen. Then an anonymous email reached the newsroom with photographs of identifiable people, marked up for surgery. A woman shown in them confirmed the images were hers. That Friday, the hackers published photographs and data of 15 Lithuanian clients on the dark web.

By 31 May, the Guardian reported, a group calling itself Tsar Team had released more than 25,000 private photographs, including nude pictures. Clients in more than 60 countries were targeted, and more than 1,500 British patients were listed in the database. Part of it was released in March, police said, and the rest the day before the Guardian published.

The extortion was organised. The hackers first tried to sell the whole database for 300 bitcoin, and the clinic refused. Then they turned to patients, with demands between 50 and 2,000 euros in bitcoin, scaled to how sensitive the data was. 15min reported that at least three patients received texts saying their data was online and could be removed for payment. One told the outlet she did not click the link.

"It's extortion. We're talking about a serious crime," said Andzejus Raginskis, deputy chief of Lithuania's criminal police bureau. Dozens of patients had come forward. The clinic's director, Jonas Staikunas, said: "Clients, of course, are in shock. Once again, I would like to apologise." The clinic told patients not to engage with the blackmailers or download anything sent to them, and to inform the police at once. Police also warned that people who download and store the stolen data could themselves be prosecuted.

Medibank, 2022: health claims as a weapon

Medibank is one of Australia's largest private health insurers. According to the Office of the Australian Information Commissioner (OAIC), the breach was notified to it on 25 October 2022. Attackers had accessed the personal information of millions of current and former customers, and it was later released on the dark web.

SBS News reported in November 2022 that the criminals released a file called "abortions.csv", then "Boozy.csv", with information related to alcohol issues, and then one called "psychos", apparently relating to mental health treatment. SBS also reported that Medibank had refused to pay a ransom. The labels were chosen to humiliate people who had simply gone to a doctor and claimed on their insurance.

SBS spoke to a woman it called Sonia, a name used instead of her real one. Her 77-year-old father, diagnosed with severe depressive disorder and bipolar disorder, had just been admitted to a psychiatric hospital. She feared his inpatient claims and his electroconvulsive therapy claims would be exposed, and she had not told him about the breach. "This is information that he has the right to control, who knows that about him," she said. She described a sense of violation and lost control, and constant dread about every message from an unknown number. She said the strain affected his self-confidence, which linked to his feelings of unworthiness, and added: "the problem is not him, the problem is that there are people out there with malicious intentions who are committing these crimes."

In June 2024 the OAIC filed civil penalty proceedings in the Federal Court, alleging that from March 2021 to October 2022 Medibank seriously interfered with the privacy of 9.7 million Australians by failing to take reasonable steps to protect their information. These are allegations, and the court decides the outcome. But the regulator's description of the harm is clear: the release exposed people to serious harm, "including potential emotional distress and the material risk of identity theft, extortion and financial crime."

	Ashley Madison (2015)	Grožio Chirurgija (2017)	Medibank (2022)
What leaked	Account records: names, addresses, emails, card transactions, messages	Patient records and more than 25,000 photographs, many nude	Health claims data, released in labelled files
How extortion reached people	Threats to send proof of membership to family and colleagues	Patient-by-patient demands of 50 to 2,000 euros in bitcoin	Public release after the ransom was refused; fear of follow-up scams
Side scams	Paid erasure services; malware on hack-checking sites	Texts offering a link to delete data	Concern about scam texts and calls
Authorities	Toronto police: extortion confirmed, two unconfirmed reports of suicides	Lithuanian police: dozens of blackmail reports, up to ten years' prison	OAIC: risk of distress, identity theft and extortion; penalty case filed 2024

How extortion after a breach works

A breach and an extortion are separate events. The breach is the theft. The extortion is a business decision made afterwards, and the cases above show its usual stages.

1. Theft. Attackers get into a server holding sensitive records. The Guardian noted a Lithuanian report that found clinics, travel agencies and private doctors' offices particularly vulnerable.
2. Pressure on the company. The criminals demand payment. In the Grožio and Medibank cases the organisation refused, and the data then appeared.
3. A sample goes public. Part of the data is released to prove the threat: 15 clients in Lithuania, two Ashley Madison members before the main release.
4. Pressure on individuals. Messages reach the people in the files by text or email, with a price and a deadline that rises with the sensitivity of what is held.
5. Copycats. Others use the news to run scams of their own, such as fake erasure services and fake deletion links.

Deadlines are part of the pressure: a frightened person acts before thinking or asking anyone. Slowing down is the most useful thing you can do.

Being blackmailed is more than a security problem. It is an experience of being cornered, and that experience has its own name and its own research. The next section turns from the technical side to the human one, and a sister page on ema.live looks at emotional blackmail itself.

What being exposed does to the mind

The 2024 study asked participants to complete the Impact of Event Scale, Revised, a standard questionnaire measuring stress symptoms after a distressing event. More invasive and consequential breaches predicted higher scores. Women scored higher than men even after anxiety and worry were accounted for. Heavier daily social media use went with higher scores, and greater digital security expertise with lower ones. The authors say these relationships need further study, so treat them as signals, not rules.

The same article says, citing media reports, that public shaming, embarrassment and extortion attempts after the Ashley Madison leak harmed many careers and relationships and were linked to several suicides. That describes reports, and no single cause can be assigned to any person's death.

The news reports add how the distress feels from the inside.

• Shock and a sense of violation. The Lithuanian clinic's director described clients in shock, and Sonia spoke of her father's lost control.
• Hypervigilance. She described stress at every unknown call and the strain of judging whether each message was real, harmful, she said, even for people with no pre-existing condition.
• Shame that belongs to someone else. Her father believed something was wrong with him. The fault lay with the criminals.
• Fear for other people. Toronto police spoke of children, spouses and partners.

There is also reason for hope. Toronto police said they were not interested in judging the site's users, Lithuanian police treated patients as crime victims, and an Australian regulator named emotional distress as a harm in its own right.

What to do if your data has leaked or you are being blackmailed

These steps combine what police and the clinic advised in these cases with the FBI's guidance on sextortion.

1. Do not answer. Do not reply, argue or negotiate.
2. Do not pay. Payment does not buy deletion. Toronto police said that once a database is copied across several sites, nobody can erase it. The Lithuanian hackers had tried to sell the data in bulk before turning to individuals.
3. Do not click the link. Offers to remove your data were flagged as scams in Toronto and Lithuania. The FBI also tells sextortion victims to avoid anyone offering help for a fee.
4. Keep the evidence. Screenshot messages, usernames, payment addresses and dates. Do not delete the thread.
5. Report it. In the United States use tips.fbi.gov, call 1-800-CALL-FBI or file at ic3.gov. In the UK use actionfraud.police.uk, and for under-18s CEOP. In Lithuania and elsewhere contact local police, as the clinic told its patients. If identity documents leaked, identitytheft.gov explains the next steps.
6. Ask for intimate images to be blocked. For adults, stopncii.org makes a digital fingerprint, called a hash, of images on your own device, and the images are not uploaded. Participating platforms look for matches and remove them if they break their rules. It cannot reach the whole internet, only its partner platforms, so keep your case number and PIN. For under-18s, use takeitdown.ncmec.org.
7. Tell one person you trust: a friend, relative, doctor or counsellor. Blackmail depends on secrecy.
8. Secure your accounts. Change the password of the breached service and any account sharing it, turn on two-step login, and tell your bank if card details were included.

What the companies owed the people in their files

Customers handed over information believing it would be protected. The Australian regulator's case rests on that idea. Under Australian Privacy Principle 11.1, Medibank had to take reasonable steps to protect the information it held from misuse, interference and loss. The OAIC alleges the steps were not reasonable given the company's size, resources and the sensitivity of the data. Privacy Commissioner Carly Kind said organisations have an ethical as well as a legal duty to protect personal information.

• Protection matched to sensitivity. A clinic storing nude pre-surgery photographs or an insurer holding psychiatric claims carries more responsibility than a shop.
• Honesty from day one. The Lithuanian clinic's early claim that photographs could not have been stolen was contradicted within days.
• Clear warnings to those affected, including that scammers will exploit the news and that nobody can remove data for a fee.
• Support that fits the harm. Sonia said one-year credit monitoring and counselling phone numbers were detached and not enough.
• Not treating customers as the problem. In her words, the customers whose data was breached are the victims.

Professor Carsten Rudolph of Monash University told SBS that systems should be built so that users' perfect care is not required, and that responsibility lies with companies and governments. If you are blaming yourself, that is a useful way to hold it.

How to lower the risk before anything happens

No one can fully prevent a breach on somebody else's server. These steps shrink what can be stolen and what a scam can use.

• Share less. Professor Rudolph suggested fewer phone apps and skipping special-deal sign-ups. Each account is one more place for a leak.
• Know the tools before you need them: stopncii.org for adults, takeitdown.ncmec.org for under-18s.
• Ask clinics and providers what they store, who sees it and when it is deleted.
• Use a different password for each service, with two-step login.
• Check a suspicious message without its own details. Professor Rudolph advised calling a number you already trust, not one in the message.
• Agree a family rule such as 'show me before you click', especially for older relatives, as Sonia's story shows.

If you need to talk to someone now

If you are in the middle of blackmail or a leak and cannot see a way through, please speak to a person today. The sense that this will never end is part of the shock, and it can ease with support.

• United States: call or text 988, the 988 Suicide & Crisis Lifeline, at any hour.
• United Kingdom and Ireland: call Samaritans on 116 123, free at any time.
• Elsewhere: call your local emergency number, such as 112 in the European Union. Australian readers can reach Lifeline on 13 11 14, the number SBS published.
• If someone is in immediate danger, call the emergency number first.

You can also tell a doctor, friend or relative one sentence: "Someone is threatening me with my private information and I need help." That is enough to begin.

Frequently asked questions

My data was leaked. What should I do first?

Do not reply to any message that arrives, do not pay and do not click links. Keep screenshots, change the password for the breached service and any account that shares it, and report it to the police or to the FBI at tips.fbi.gov or ic3.gov in the United States, or Action Fraud in the UK.

Is blackmail after a data breach real?

Yes. After the Ashley Madison leak, Toronto police confirmed attempts to extort members by threatening to send proof of their membership to family and colleagues. In Lithuania, dozens of clinic patients reported being blackmailed with demands between 50 and 2,000 euros in bitcoin.

Should I pay if someone threatens to publish my private data?

No. Payment does not guarantee deletion, and once data is copied across the internet nobody can erase it, as Toronto police said about the Ashley Madison database. Paying can also lead to further demands. Report the threat instead.

Why is a medical data breach worse than a normal one?

Medical details cannot be changed and are tied to stigma, such as mental health care or reproductive health. Australia's privacy regulator said the Medibank release exposed people to potential emotional distress and the risk of extortion, in addition to identity theft and financial crime.

How do I get intimate images removed after a leak?

If you are an adult, StopNCII.org creates a hash of the images on your own device and shares that fingerprint with participating platforms, which can then remove matching images. It cannot remove images from the whole internet. Under-18s can use takeitdown.ncmec.org. The FBI warns against paying anyone who offers removal for a fee.

What did Ashley Madison hackers do with the data?

According to Toronto police and the Guardian, the Impact Team published the stolen customer data on 20 August 2015 after announcing the hack on 20 July. Reports of the number of profiles vary between about 32 and 37 million. Extortion attempts and scams followed within days.

Can I take legal action against a company that lost my data?

It depends on your country. In Australia, the OAIC accepted individual and representative complaints about Medibank and filed civil penalty proceedings in 2024. Ask your national data protection regulator or a lawyer what applies to you.