Breach Disclosure: Gab

The social-media platform Gab has reportedly been breached by a group named DDoSecrets and released to certain individuals on February 28th, 2021. Through the use of a SQL injection vulnerability in Gab, DDoSecrets were able to siphon not only all of Gab's public posts and profiles, but also private group and private individual posts and messages, along with user and group passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

This breach impacted the entire userbase of Gab, with more than 70GB of data representing more than 40 million posts. While this data could be extremely dangerous in the wrong hands, DDoSecrets is aware of that fact and chose to only release the data to journalists, social scientists, and researchers.

This is the latest breach related to "hacktivism", stemming from the Parler breach earlier this year, which exposed data on Parler users and potential relations to the United States Capitol Riots on January 6th. DDoSecrets had some involvement in this, with their co-founder sharing analysis and data on Parler as well as perserving the data along with the Internet Archive.

While the data will most likely not go public, although possible, there are unencrypted passwords contained in the data dump, which could be used by hackers for other account takeovers.