Ashley Madison let people deactivate their accounts for free. Deactivated accounts weren't deleted: the site kept them indefinitely. To have a profile actually removed, a user had to pay a $19 fee for a "full delete", a charge not disclosed when they signed up.
In July 2015 the site was breached, and about 36 million accounts were exposed.
In August 2016 Canada's and Australia's privacy regulators published a joint report. They found that charging people to withdraw consent broke the law, and that keeping deactivated accounts indefinitely did too: "ALM's practice of indefinite retention contravenes PIPEDA Principle 4.5 and APP 11.2." Their evidence was the company's own data: of the users who deactivated and came back, 99.9 percent did so within 29 days.
What it shows
Closing an account isn't deleting it. A company can keep everything behind a deactivated profile, and a breach doesn't care whether you thought you'd left.
For your own record
Before you leave a service, send a deletion request in writing from the account's email address, and keep the reply. If the company says it keeps some data, the reply tells you what and for how long.