Following the sophisticated hack of adultery site Ashley Madison last July, some of its users were sent letters by blackmailers, threatening to expose them unless they sent large sums of money.
Blackmailers obtained the personal information of many of the site’s 33m users, after hacker group The Impact Team posted the data on the Dark Web.
The leaked information included the names, email addresses and credit card details of the site’s users, with criminals subsequently using home addresses to send blackmail letters to users, threatening to expose their use of Ashley Madison to their loved ones.
However, it has emerged that the blackmailers have now taken a more sinister route, directly targeting the wives of men who had signed up to the site, by sending messages through the US postal service.
This was first brought to light by security researcher Graham Cluley, who over the past few weeks has been contacted by a number of people who have intercepted these letters before their wives opened them.
These letters were sent out to the people who had ignored the blackmailer’s original letters, which threatened to reveal their secret if they did not pay a sum of money via Bitcoin.
After addressing the letter to the user’s wife, the blackmailer proceeds to explain how the woman’s husband is a user of the cheating service, detailing how the letter was sent after her husband had ignored their first financial demands.
On his site, Cluley posted an example of one of these letters:
Dear Mrs [Redacted] I am afraid this letter contains bad news. Perhaps you remember hearing in the news this past summer about a website called “Ashley Madison” being hacked. Ashley Madison is a website that facilitates people meeting each other that wish to commit adultery. The hackers released the membership and billing details of all the members. I am sorry to tell you that [Redacted] is a member of that adultery website. You, and some people you know, will be hearing from me via electronic communication in the near future with links and detailed instructions on how to confirm what I am telling you. But if you wish to do your own research before then you can search “Ashley Madison database” on Google to learn how to find it. Once you do find it you will see [Redacted] has entries in the database, including on [Redacted]. He signed up under the name “[Redacted]”, used this mailing address as his billing address and used [Redacted] for his email address. But as I said, if you have difficulty locating the database, and it can be tricky, I will be contacting you via other means in the not too distant future. That is also for my own peace of mind in case [Redacted] intercepts this letter before you read it.
Why am I telling you and people close to you about this? Well, a while back I sent [Redacted] a letter telling him if he did not send me $2,000 I would reveal his secret to you. Well, he didn’t pay. Either he thought I was bluffing or he decided to man up and tell you the truth. If he told you the truth I can respect that, but you should probably go ahead and prepare your friends and family for the impending communications from me. You can come up with some excuse to tell them in order to try and save you some embarrassment if you wish. Perhaps tell them he had his identity stolen and it wasn’t really him. They might be naive enough to fall for that. I told [Redacted] that if he didn’t pay I would be telling not only you but others close to you about his misdeeds. I guess your dignity wasn’t worth $2,000 to him.
You will probably show this letter to [Redacted] when you confront him so I would like to close with a little message for him. Hey [Redacted]! You probably thought I forgot about you, didn’t you? I told you missing the deadline would only bring you misery. I am sure you assumed I was just sending out multiple form letters hoping some small percent would pay up and that I wouldn’t actually waste time and money on going through with my threat. Well, you were half right. I’m a crook, but I’m not a liar.
Interestingly, this statement is being accompanied by a letter addressed directly to the husband, predicting that some of the letter may be intercepted before the wife sees them.
In this letter, the blackmailer offers the man one final chance to pay for his secrecy, this time demanding a higher amount than in the first letter.
The criminal justifies this increase as a “penalty for making [them] ask twice”.
While the new letters are extremely alarming, it also suggests a hint of desperation on the criminal’s part, in that their first attempts were unsuccessful so they are having to make more serious threats.
Offering his advice, Cluley said: “I would recommend that anyone who receives a blackmail threat through the US Postal Service contact the US Postal Inspectors Service and FBI so that they can investigate.
“I haven’t seen any reports of Ashley Madison blackmails being sent by post outside the United States.”
See Cluley’s full original blog post here.