Ars has already chronicled the feeding frenzy among lawyers trying to capitalize on the epic Ashley Madison data breach. Now there's word of scam sites charging hefty fees to expunge the data of exposed members and attempts to extort people caught up in the privacy nightmare.

One of the best known offenders is known as Trustify, which bills itself as a private investigator service. According to security researcher Troy Hunt, Trustify is sending unsolicited e-mails with the subjects such as "Your boss might know" to many of the 36 million addresses included in the resulting dump.

"There are ways to hide the exposed details, but first you need to see what information can be found across the Web," one of the e-mails states, glossing over the reality that the highly personal data leaked in the Ashley Madison hack is a permanent part of the Internet record. "Talk with our experienced investigative consultants to learn how you can find our [sic] what incriminating information is available and could ruin your life."

As if the unsolicited, ambulance-chasing e-mails weren't unseemly enough, Trustify is one of several companies that makes it easy to find out if an e-mail address was among those associated with an Ashley Madison account. The service is free and allows anyone—say, a boss, neighbor, or loan investigator—to check any address. In other words, Trustify is making it much easier for Ashley Madison subscribers to be exposed at the same time that it extends misleading promises to those same unfortunate people. Contrast the Trustify system with a service such as Have I been pwned, which only provides information about affected addresses to people who prove they have ownership of them.

Update: Late on Monday, Trustify said it was suspending the search service until it added an e-mail verification mechanism similar to the one Have I been pwned uses. Even later in the da, Trustify once again made the search service available without any verification, Hunt said.

Trustify sends the unsolicited e-mails to any address that was included in the Ashley Madison dump and was later searched for on the Trustify service, according to Hunt. A few days later, Hunt said, Trustify will send a follow-up e-mail.

Blackmail

Extortionists are perpetuating an even more blatant scam targeting outed Ashley Madison subscribers. The e-mail at the top of this post, provided by the Toronto Police Service investigating the hack, shows one such attempt. It threatens to notify family members, friends, and employers of the recipients' relationship with the dating site unless they pay about $225 in anonymous Bitcoin.

Unfortunately, there's absolutely nothing people exposed by this hack can do to prevent incriminating data from being available to anyone with a moderate amount of motivation to find it. For those who want to know if their e-mail address was exposed, Have I been pwned, linked above, is a service run by a known whitehat security researcher Ars trusts (more here). People who receive e-mails promising to delete records or extorting hush money should under no circumstances respond to the senders or pay any fees. Whatever damage has been done can't be undone. Responding or paying the fees will only make things worse.