For a comprehensive timeline, please see Josh Duggar Scandal Chronology
On August 19, 2015, Gawker.com published an article with the title "Family Values Activist Josh Duggar Had a Paid Ashley Madison Account". This launched a series of articles, from Gawker and other sources, revealing that twenty-seven year old Josh Duggar had a paid account on the website Ashley Madison, a service that assisted married people in having affairs.
On July 15, 2015, a group that identified themselves as The Impact Team announced that they had hacked the database of Avid Life Media, and would be posting large caches of data that they had stolen from many of the websites managed by Avid Life, including AshleyMadison.com, a website that assisted people in having affairs, if their demands weren't met:
"We are the Impact Team. We have hacked them completely, taking over their entire office and production domains and thousands of systems, and over the past few years have taken all customer information databases, complete source code repositories, financial records, documentation, and emails, as we prove here. And it was easy. For a company whose main promise is secrecy, it’s like you didn’t even try, like you thought you had never pissed anyone off.
Avid Life Media has been instructed to take Ashley Madison and Established Men offline permanently in all forms, or we will release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails. The other websites may stay online.
So far, ALM has not complied."
On July 20, 2015, three statements were posted on AshleyMadison's "Media" section. One of the statements read:
"At this time, we have been able to secure our sites, and close the unauthorized access points. We are working with law enforcement agencies, which are investigating this criminal act. Any and all parties responsible for this act of cyber-terrorism will be held responsible. Using the Digital Millennium Copyright Act (DMCA), our team has now successfully removed the posts related to this incident as well as all Personally Identifiable Information (PII) about our users published online."
On July 21, 2015, more than 2,500 customer records were published. Despite the fact that AshleyMadison was waving the fee to delete your account info, Avid Life claimed that the info published was not legit.
On August 19, 2015, after more information was released, Avid Life confirmed that the data was authentic.
On August 19, 2015, the website Gawker, which had been combing through the data released by The Impact Team, published a story announcing that Josh Duggar had maintained a paid account on AshleyMadison.com while he was working for the Family Research Council, a conservative lobbying group in Washington, D.C.
An account with a credit card that belonged to Joshua J. Duggar, whose billing address matched a home owned by Mary Duggar in Fayetteville, AR, paid a total of $986.76 for two separate Ashley Madison subscriptions between February, 2013, and May, 2015.
Josh provided the following list of turn-ons that he was looking for:
professional/well groomed, stylish/classy, casual jeans/t-shirt type, muscular/fit body, petite figure, tall height, short height, long hair, short hair, girl next door, naughty girl, sense of humor, imagination, creative and adventurous, relaxed and easy going, aggressive/take charge nature, confidence, discretion/secrecy, good listener, good personal hygiene, average sex drive, high sex drive, dislikes routine, has a secret love nest, disease free, drug free, natural breasts
The second account, which was opened in July of 2014, was linked to his home in Oxon Hill, Maryland. The first account used a birthday one month before his actual birthday, while the second one used a birthday one day before.
When the second account was opened, he paid a $250 fee that appears to been for an "affair guarantee". 
Later that day, Gawker posted a second article, announcing that Josh's AshleyMadison email address, firstname.lastname@example.org, was also connected to an OKCupid profile, using a photo that comes up as one of the first results when you google "random guy". The profile had not been active since September of 2014, which is when the first AshleyMadison account stopped being active. On August 20, 2015, this account was deleted.
On August 20, 2015, Josh published the following statement on his family's website:
I have been the biggest hypocrite ever. While espousing faith and family values, I have secretly over the last several years been viewing pornography on the internet and this became a secret addiction and I became unfaithful to my wife.
I am so ashamed of the double life that I have been living and am grieved for the hurt, pain and disgrace my sin has caused my wife and family, and most of all Jesus and all those who profess faith in Him.
I brought hurt and a reproach to my family, close friends and the fans of our show with my actions that happened when I was 14-15 years old, and now I have re-broken their trust.
The last few years, while publicly stating I was fighting against immorality in our country while hiding my own personal failings.
As I am learning the hard way, we have the freedom to choose our actions, but we do not get to choose our consequences. I deeply regret all the hurt I have caused so many by being such a bad example.
I humbly ask for your forgiveness. Please pray for my precious wife Anna and our family during this time.
Josh edited the statement a number of times after initially posting it.
On August 21, 2015, a Facebook account was discovered that was linked to the same email account used for Josh's AshleyMadison email address. The account, which was registered under the name Joe Smithson, had been posting as early as 2004, when Josh was sixteen years old. The account was friends with 32 women from Arkansas, and followed Sensations Gentleman's Club in Arkansas.
On September 2, 2015, an anonymous woman claimed to have had a pregnancy scare after having unprotected sex with Josh. Nothing ever became of this allegation.
On September 30, 2015, an anonymous porn star claimed to have had an experience with Josh that was similar to the one previously reported by Danica Dillon.
On October 3, 2015, Josh was mocked in the show Saturday Night Live, in a sketch where he was played by Bobby Moynihan, who doubled as child molestor and former Subway spokesman Jared Fogle.
On October 14, 2015, it was reported that Josh and his wife Anna had sold their home in Siloam Springs, AR, on August 24.
On August 22, 2015, Matthew McCarthy, the Hollywood-based DJ whose photo had been used on Josh's OkCupid and Facebook accounts, spoke to the tabloid magazine TMZ, saying that he lost out on a gig because of the club's belief that he was involved in a sex scandal.
On August 5, 2016, it was reported that Matthew McCarthy was suing Josh for an undisclosed amount after losing work and facing harassment due to Josh's usage of his image. 
As of August, 2017, this lawsuit is still ongoing.
On August 26, 2015, porn star Danica Dillon claimed that she had had sex with Josh on two separate occasions after he approached her at a strip club she was performing at in mid-March. According to Dillon, he offered her $1,500 for sex, which turned violent, but only paid her $1,000. 
On November 18, 2015, it was reported that Danica Dillon had filed a lawsuit against Josh for "assaulting her to the point of causing physical and emotional injuries" while having consensual sex. She was asking for $5000,000 in damages. This suit gave further details of their interactions, saying that he had paid about $600 for lap dances before inviting her to his hotel room, where he paid her $1,500 for sex that was violent enough to make her feel like she was being raped. A month later, he tried to apologize to her, but was actually just using that as a guise to assault her again. 
On February 5, 2016, it was reported that she had dropped her lawsuit and promised not to refile. She acknowledged at this time that documents Josh produced proved that she had lied. She then took to social media, claiming that she hadn't lied.
On August 26, 2015, the Duggar family posted a statement saying that Josh checked himself into a long-term treatment enter.  By August 27, 2015, many online sources began to speculate that this treatment center was Reformers Unanimous in Rockford, IL, after flight records revealed that Josh's brother, pilot John David Duggar, had landed in Rockford, IL, around midnight on August 24, and had left again at 12:25a to return home. Josh's parents had previously spoken highly of the center after speaking there the year before: "They are an incredible Christian based drug/ alcohol addiction program. While there, we saw our good friends Godfrey and Launa Watson from Jamaica, too. Love supporting organizations and events like these."
On January 23, 2016, Anna Duggar published the following statement on the Duggar family's website:
“Many have asked how I am doing. So many have asked that its actually humbling and touching. 2015 was the most difficult year of my life. Yet, amazingly I’ve found that in my own life crisis God has drawn near to me ("He’s near to the brokenhearted” Psalms 34:18) and my faith has been more precious to me than ever before. Just recently I visited Josh. It was an important step on a long difficult road. I want to thank all of you for your prayers and your messages of hope. I can never express how your kindness and prayers have brought encouragement when I needed it most—outpacing the grief and discouragement at every turn. I trust that God will continue to show His love and tenderness toward us and bring beauty from ashes—somehow—as only He can do. Please continue to pray for me, Josh and our children.”
On March 10, 2016, Josh's family released the following statement about Josh's release from rehab:
Josh has completed his residential rehabilitation program. We are so thankful for everyone who worked with Josh in this program. It was a crucial first step in recovery and healing for Josh. Josh has now returned to Arkansas, where he will continue professional counseling and focus on rebuilding relationships with his family. We look to God for help and guidance and place all of our trust in Him. We are forever grateful for the love and prayers offered by so many and hope you will continue to pray in the days ahead.