Breach Disclosure: ge.tt

ge.tt, the file sharing service experienced a data breach in December of 2017, with data now being publicly available for users to download on various forums and marketplaces. This breach was carried out by Gnosticplayers, who have played a large role in posting these breaches for quite some time. This breach impacted 2,481,121 accounts including user's names, social media profile identifiers, and SHA256 password hashes.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

This breach was listed for sale on dark web marketplaces along with 24 other companies around the time this originally was up for sale. When listed, this data went for around 4 bitcoins, now this data is freely distributed on hacking forums.

imgur Figure 1: Breach advertisement on RaidForums

Gnosticplayers have for the most part been relatively quiet since their breaching spree, with actors such as Shiny Hunters taking their place, but the effects of Gnosticplayers are still present, with this data still available online for users to download. This data, along with their other breaches can be invaluable in some scenarios when attempting to exploit users or companies.