Lawyers score big in settlement for Ashley Madison cheating site data breach

The owners of the Ashley Madison cheating-dating website have agreed to pay $11.2 million to settle two dozen data breach lawsuits as a result of a 2015 incident involving as many as 37 million members' personal identifying information being exposed online. The deal (PDF) earmarks up to one-third, or about $3.7 million, for attorneys' fees and costs. An additional $500,000 has been set aside to administer the remaining $7 million earmarked for Ashley Madison members.

The breach and the lawsuits highlight the site's poor security and deceptive business practices, which have also resulted in a $1.6 million settlement with the Federal Trade Commission and several states. A Missouri federal judge must sign off on the latest deal, which was submitted in federal court Friday.

Under its terms, members who submit a "Valid Claim form and Reasonable Documentation" will be refunded their $19 if they had purchased the $19 "Full Delete" feature. Members who paid that fee were supposed to have their data deleted from the site's servers, but it wasn't—such data was infamously exposed in the hack.

Ashley Madison parent company Avid Life Media, now Ruby Corporation, admitted no wrongdoing under terms of the accord.

While Ruby denies any wrongdoing, the parties have agreed to the proposed settlement in order to avoid the uncertainty, expense, and inconvenience associated with continued litigation and believe that the proposed settlement agreement is in the best interest of Ruby and its customers. In 2015, hackers gained access to Ruby's computer networks and published certain personal information contained in Ashley Madison accounts. Account credentials were not verified for accuracy during this time frame and accounts may have been created using other individuals' information. Therefore, Ruby wishes to clarify that merely because a person's name or other information appears to have been released in the data breach does not mean that person actually was a member of Ashley Madison.

What's more, the deal will also provide a dollar-for-dollar refund of up to $500 to members who submit a valid claim form proving they spent money to chat with so-called "engagers." As many as 70,000 of the engagers were bots of fake female profiles that would chat with curious men on the site in exchange for a fee.

What's more, members who were victims of identity theft as a result of the breach can get up to $2,000 to recover, on a dollar-per-dollar basis, money lost because of that breach.

If combined claims exceed the settlement monetary pie, funds "will be allocated on a pro-rata basis based on each claim's recognized loss as compared to all recognized losses for all claims," according to the deal. Any remaining funds in the pool "will be divided equally amongst Settlement Class Members who submit a Valid Claim Form and Reasonable Documentation demonstrating that his or her Personal Information was released publicly as a result of the Data Breach. Settlement Class Members submitting such a claim are eligible to receive no more than five hundred dollars...."

The deal requires confidentiality for the Ashley Madison members who seek a piece of the settlement pie. The settlement said the owners of the Ashley Madison site, which is still active, have added new security measures to the website.

A settlement hearing has been set for July 21 before US District Judge John Ross in the Eastern District of Missouri.