Gab – 66,521 Accounts Breached Exposing Emails, Password Hashes, and Private Messages
What Happened – In February 2021 the alt‑tech social network Gab suffered a data breach that released roughly 70 GB of data. The leak included full user profiles for about 66 k accounts—email addresses, usernames, bcrypt‑hashed passwords, avatars, and a subset of private chat logs.
Why It Matters for Trust & Control Assurance
- Credential exposure shows the need for strong identity‑and‑access controls and continuous monitoring of credential storage practices.
- A defensible audit trail of password‑handling policies (e.g., hashing, salting, rotation) is essential to demonstrate due diligence after a breach.
- Evidence‑based incident response and proof of remediation are core to any control‑assurance program.
Who Is Affected – Social‑media platforms, online community services, and any organization that stores user credentials and private communications.
Recommended Actions
- Immediately force password resets for all affected accounts and enforce multi‑factor authentication where possible.
- Review and harden credential storage (ensure strong hashing, peppering, and limited access).
- Document the incident response steps and collect evidence for audit readiness (e.g., logs, remediation tickets).
Technical Notes – The breach released user‑profile data, bcrypt password hashes, and a limited set of private messages. The exact attack vector was not disclosed. Source: https://haveibeenpwned.com/api/v3/breach/Gab