Are affair sites safe? Breaches, billing and privacy

Are affair sites safe? Not by default. The biggest one leaked 36 million accounts in 2015, and the more likely leak is closer to home: a card statement, an App Store receipt or a lock-screen preview. With a separate email, payment only you see and notifications off, you can close most of those gaps.

If you use a married-dating site, the people you are hiding it from are rarely hackers. They are the person who opens the card statement, the family member who gets the App Store receipt, or whoever glances at a lock screen when a message arrives. Hackers are the second risk, and they are not hypothetical: the biggest breach in this corner of the internet put tens of millions of affair-site accounts online, and people in that data were still getting blackmail emails five years later.

This guide covers both. First, what the Ashley Madison breach and others actually exposed, and what regulators found the companies had promised and failed to do. Then the everyday paper trail: billing names, app-store family plans, notifications and account history. Last, a setup that limits the damage, how to leave a site properly, and what to do if an extortion email arrives. We don't judge why you want privacy. We just want the setup to hold.

What did the Ashley Madison breach expose?

Nearly everything: paying customers' names, email addresses, sexual preferences, billing addresses and partial card numbers, across more than 36 million accounts, including people who had paid to be deleted.

The hack

According to the FTC's complaint, a group calling itself "The Impact Team" published 9.7 gigabytes of data on more than 36 million AshleyMadison.com customers on August 18 and 20, 2015. The dump included the full names of paying customers and the usernames and email addresses of non-paying ones, together with relationship status, date of birth, sexual preferences, desired encounters, security-question codes, hashed passwords, billing addresses and the last four digits of card numbers. For some customers, full card numbers were in the data. The complaint also says intruders had been inside the company's network several times between November 2014 and June 2015 without being detected.

Canada's and Australia's privacy commissioners investigated jointly and found that the parent company, then called Avid Life Media, had no adequate overarching security framework: remote access relied on a single factor, a shared VPN passphrase was stored where many staff could reach it, and only about a quarter of staff had been through the new security training. The site was selling discretion while running on that.

The "Full Delete" that didn't delete

The detail that should change how you think about any account is the paid deletion. Until July 2015, Ashley Madison charged $19 for a "Full Delete" that promised to remove profiles, messages, photos and personal information. The FTC's complaint says 125,714 US consumers paid a total of $2,388,566 for it between December 2012 and December 2015, that the company often kept personal information for up to 12 months afterwards, and that it only told people about that retention after they had paid. Data from people who paid for Full Delete was in the published dump.

The FTC settlement announced in December 2016 also charged that the site displayed a "Trusted Security Award" it had never received. The operators paid $1.6 million in total to settle with the FTC, 13 states and the District of Columbia, under an $8.75 million judgment that was partly suspended, and agreed to a security program with outside assessments. In the US class actions, the parent, by then renamed Ruby Corp, agreed in July 2017 to pay $11.2 million without admitting wrongdoing.

Unverified email addresses cut both ways

The FTC complaint notes that Ashley Madison did not verify the email addresses people signed up with, and the privacy commissioners found that this broke the accuracy rules because non-users could be falsely linked to the site. After the dump, websites appeared that let anyone type in an email address to see whether it was in the data. An address appearing there was never proof that its owner used the site. Still, that was little comfort to anyone whose spouse ran the search.

Why do Ashley Madison extortion emails still arrive?

Because the 2015 data never went away. Criminals still mail people in it, quoting real usernames and sign-up dates to make an old leak look like fresh access.

Within days of the 2015 dump, Brian Krebs published an extortion email sent to someone in the data: "your data was leaked in the recent hacking of Ashley Madison and I now have your information," with a demand for 1.0000001 bitcoin (about $225 then) within seven days.

The data did not go stale. In early 2020, almost five years later, the email-security firm Vade (now part of Hornetsecurity) reported several hundred extortion emails in a single week, mostly aimed at people in the US, Australia and India. They quoted each target's Ashley Madison sign-up date, username and the interests they had selected, asked for 0.1188 bitcoin (about $1,059), set a six-day deadline, and hid the demand in a password-protected PDF with a QR code so spam filters wouldn't catch it.

This is a big, ongoing crime category. The FBI's 2025 Internet Crime Report lists 89,129 extortion complaints and $122.5 million in reported extortion losses for the year, and more than 75,000 submissions about sextortion. Most mass "I have your password and a video of you" emails are bluffs built on old breach data. The FTC's advice is blunt: a real old password in the email usually just means your address was in a breach.

Have other affair and dating sites been breached?

Yes. The 2016 FriendFinder Networks breach, which included AdultFriendFinder, was more than ten times the size of Ashley Madison's, and in 2026 attackers claimed records from Match Group's apps, OkCupid among them.

• FriendFinder Networks, 2016. CSO reported 412,214,295 accounts exposed across the company's sites, 339,774,493 of them from AdultFriendFinder, with passwords stored in plain text or as weak SHA-1 hashes. TechCrunch reported that over 15 million accounts users had deleted were still in the data. See our AdultFriendFinder review.
• OkCupid, 2026. Not a hack: in March 2026 the FTC charged that OkCupid gave nearly three million user photos, with location and other information, to an unrelated company its founders had invested in, and that Match and OkCupid then concealed it. The proposed order bars them from misrepresenting how they handle data. Separately, in January 2026 the group ShinyHunters claimed more than 10 million records from Match Group, naming OkCupid, Hinge and Match.com; Match Group confirmed a security incident and said it saw no sign that logins, financial information or private messages were accessed. Our OkCupid review has the rest.

Have I Been Pwned lists the Ashley Madison breach (about 30.8 million email addresses) and the 2016 AdultFriendFinder breach (about 169.7 million) as "sensitive": only the verified owner of an address can see whether it was in them. That is the right way to check your own exposure. It also means nobody can use that site to look you up.

What shows up on your bank statement and phone?

Breaches make headlines. The everyday leaks are small, boring and much more likely: a line on a statement, a receipt in a shared inbox, a banner on a phone left face-up.

What will an affair site charge say on my card statement?

It depends on the site, and you should ask before you pay. Victoria Milan says its name never appears; we could not confirm Ashley Madison's current billing name.

Every card charge carries a billing descriptor, the merchant name your bank prints. Some sites deliberately use a bland one. Victoria Milan's payment help page says "the name VictoriaMilan will never appear on your bank statement", and its terms name its payment processor as Neon Media Labs Kft, doing business as Digisecbilling. We could not confirm Ashley Madison's current descriptor from its own pages, and third-party claims about it disagree, so don't rely on a blog post. Ask the site's support what the charge will say before you pay.

A neutral name only helps if nobody else reads the statement:

• A joint card or a card on a shared banking app shows the charge to both of you, whatever it is called. A strange recurring amount from an unknown merchant can draw more attention than a familiar name.
• Victoria Milan's help page also lists Paysafecard, a prepaid voucher bought with cash, where it is available. Availability varies by country, and a voucher still leaves a receipt somewhere.
• Memberships renew. Victoria Milan's terms say all purchases are final and non-refundable and that subscriptions may recur. Its help center says a Premium membership must be canceled before you can deactivate the profile, and that deactivating doesn't cancel what you owe. A forgotten renewal is how a lot of people get found out.

App-store purchases and family plans

Buying through the app is not more private if your phone is on a family plan. Apple's Family Sharing privacy page says that once the organizer turns on purchase sharing, members' eligible App Store purchases are charged to the organizer's payment method, and that members can hide individual purchases but "the Family organizer will continue to receive receipts for purchases made in the App Store." On Android, Google Play's family library runs on the family manager's card when you choose the family payment method at checkout. If someone else pays for your phone, read the receipt settings before you subscribe.

Notifications and the lock screen

A message preview on a locked phone is the most common giveaway there is. On an iPhone, Settings > Notifications > Show Previews offers Always, When Unlocked and Never, for all apps or per app. "Never" for the dating app is the safe choice: on phones with Face ID, glancing at your phone counts as unlocking it. Android has an equivalent lock-screen setting that hides sensitive notification content. Better still, turn the app's notifications off and check it when you choose to.

Account history and email

• Google activity. If you are signed in to a Google account, Google's My Activity can keep searches, sites visited and videos watched, and it syncs across every device on that account, including a shared tablet or the family computer. You can turn saving off or set auto-delete.
• Email. Sign up with an address used for nothing else, under a name that isn't yours. A dating site's welcome email, password reset or "someone winked at you" message in your main inbox defeats every other precaution.
• Browsers. Private browsing stops your own device keeping history. It does not hide anything from the site, your employer's network or your internet provider.

How to use an affair site safely

Assume the site will leak one day, because several have. Then make sure the leak doesn't lead back to you:

1. A separate email address, created for this, with no forwarding to your main inbox.
2. A unique, long password from a password manager. The 2020 extortion emails worked because 2015 data was still accurate; a password you used elsewhere turns one breach into many.
3. Two-factor authentication on that email account. The FTC recommends an authenticator app or security key over text messages, because SIM-swap attacks can intercept codes.
4. A username and profile text that can't be searched back to you. No employer, no neighborhood, no distinctive hobby, no photo you have posted anywhere else (reverse image search finds those in seconds).
5. Payment you control alone, with a descriptor you have confirmed and auto-renew switched off the day you subscribe.
6. Notifications off, and the app tucked away from the home screen if anyone else handles your phone.

Photos

Face photos are the one thing you can't take back. Victoria Milan offers an "Anonymizer" blur and mask tool and private photos behind "private keys" that you grant to one person at a time; once you approve a key, that person can see all your private photos. Remember the FTC's finding that Ashley Madison built fake profiles out of real members' photos: anything you upload can be reused, screenshotted or leaked. Share a clear face photo only with someone you have already video-chatted with, and never with a face and an identifying detail in the same frame.

How do you delete an affair site account for good?

Cancel the subscription, delete your own messages and photos, then ask the site in writing to erase your data. On Ashley Madison, the FTC found that deactivating only hid a profile.

"Deactivate" and "delete" are different things. On Ashley Madison, the FTC found that Basic Deactivation only hid a profile, while profile information and messages stayed visible to people you had talked to. The privacy commissioners found the company kept data from deactivated and inactive accounts indefinitely, and that charging for full deletion without saying so at sign-up broke Canadian privacy law. The company stopped charging for it. Victoria Milan's help center describes deactivation from profile settings. To get data actually erased, ask the site in writing for deletion and keep the reply. If you live in a state with a privacy law, such as California's CCPA, or in the EU or UK, you have a legal right to ask.

Before you go, cancel any subscription first, delete your messages and photos yourself, then change the account email to the throwaway one if it isn't already. Whatever the site keeps afterwards is then tied to an address nobody can link to you.

What to do if you get an extortion email

Read it calmly. It usually says less than it seems to. Then:

• Don't pay and don't reply. The FTC's advice on these emails is "Stop. Don't pay anything. Delete the message. It's a scam." The FBI says it does not condone paying extortion demands, because the money funds more of it. Paying also tells the sender you are worth trying again.
• Check what they really have. A username, sign-up date or old password points to a breach dump, not to fresh access. Change any password they quote, everywhere you used it.
• Report it to the FBI at ic3.gov, including the email headers and the bitcoin address, and to the FTC at ReportFraud.ftc.gov.
• Ignore "recovery" services that contact you offering to make it go away for a fee. If someone is threatening to share real intimate images, the FTC's guide to image-based abuse explains how to get them taken down and where to find free help.

Privacy on these sites is mostly about you, not the site. Read how the sites handle fake accounts in our guide to fake profiles on affair sites, compare the options in our Victoria Milan and Ashley Madison reviews, and if you are weighing honesty against secrecy, our guide to ethical non-monogamy vs affairs is worth ten minutes. For what an affair can mean in a divorce, see infidelity and the law.