Ge.tt – 2.48 M User Accounts Exposed in 2017 Data Breach
What Happened – In May 2017 the file‑sharing service Ge.tt suffered a breach that exposed 2,481,121 user records. The stolen data—email addresses, names, social‑media profile IDs and SHA‑256 password hashes—appeared for sale on a dark‑web marketplace in February 2019.
Why It Matters for Trust & Control Assurance
- The incident illustrates the exact scenario a continuous control‑assurance program seeks to prevent: weak credential storage and insufficient identity‑access safeguards that leave user data vulnerable to mass exposure.
- Demonstrable evidence of strong password‑hashing practices, MFA enforcement, and ongoing credential‑access monitoring is essential to provide a defensible audit trail and reassure regulators and customers.
Who Is Affected – SaaS and cloud‑hosted file‑sharing platforms; their enterprise customers that rely on the service for internal collaboration and data exchange.
Recommended Actions
- Verify that password hashes use a modern, memory‑hard algorithm (e.g., Argon2, bcrypt) and rotate any legacy SHA‑256 hashes.
- Enforce multi‑factor authentication for all user accounts and privileged service accounts.
- Implement continuous monitoring of credential‑access logs and anomalous login patterns; retain evidence for audit readiness.
- Conduct a third‑party risk review of any external storage or CDN components used by the service.
Technical Notes – The breach involved the theft of SHA‑256 password hashes, email addresses, names and linked social‑media identifiers. No specific vulnerability (CVE) was disclosed; the attack vector remains unknown. Source: Have I Been Pwned – Ge.tt breach