When Twitter banned Donald Trump and a slew of other far-right users in January, many of them became digital refugees, migrating to sites like Parler and Gab to find a home that wouldn’t moderate their hate speech and disinformation. Days later, Parler was hacked and then dropped by Amazon web hosting, knocking the site offline. Now Gab, which inherited some of Parler’s displaced users, has been badly hacked too. An enormous trove of its contents has been stolen—including what appears to be passwords and private communications.
On Sunday night the WikiLeaks-style group Distributed Denial of Secrets is revealing what it calls calling “GabLeaks,” a collection of more than 70 gigabytes of Gab data representing more than 40 million posts. DDoSecrets says a hacktivist who self-identifies as “JaXpArO and My Little Anonymous Revival Project” siphoned that data out of Gab’s backend databases in an effort to expose the platform’s largely rightwing users. Those Gab patrons, whose numbers have swelled after Parler went offline, include large numbers of Qanon conspiracy theorists, white nationalists, and promoters of former president Donald Trump’s election-stealing conspiracies that resulted in the January 6 riot on Capitol Hill.
DDoSecrets cofounder Emma Best says that the hacked data includes not only all of Gab’s public posts and profiles—with the exception of any photos or videos uploaded to the site—but also private group and private individual account posts and messages, as well as user passwords and group passwords. “It contains pretty much everything on Gab, including user data and private posts, everything someone needs to run a nearly complete analysis on Gab users and content,” Best wrote in a text message interview with WIRED. “It’s another gold mine of research for people looking at militias, neo-Nazis, the far right, QAnon and everything surrounding January 6.”
DDoSecrets says it’s not publicly releasing the data due to its sensitivity and the vast amounts of private information it contains. Instead the group says it will selectively share it with journalists, social scientists, and researchers. WIRED viewed a sample of the data, and it does appear to contain Gab users’ individual and group profiles—their descriptions and privacy settings—public and private posts, and passwords. Gab CEO Andrew Torba acknowledged the breach in a brief statement Sunday.
Passwords for private groups are unencrypted, which Torba says the platform discloses to users when they create one. Individual user account passwords appear to be cryptographically hashed—a safeguard that may help prevent them from being compromised—but the level of security depends on the hashing scheme used and the strength of the underlying password.
Among the users whose hashed passwords appeared to be included in the data were those for Donald Trump, Republican congresswoman and QAnon-conspiracy theorist Marjorie Taylor Greene, MyPillow CEO and election-conspiracy theorist Mike Lindell, and disinformation-spouting radio host Alex Jones.
The hacked data also includes a chatlogs.txt file that appears to contain private conversations between the site’s users. That file’s contents begin with an added note from JaXpArO: “FUCK TRUMP. FUCK COLONIZERS & CAPITALISTS. DEATH TO AMERIKKKA.”
According to DDoSecrets’ Best, the hacker says that they pulled out Gab’s data via a SQL injection vulnerability in the site—a common web bug in which a text field on a site doesn’t differentiate between a user’s input and commands in the site’s code, allowing a hacker to reach in and meddle with its backend SQL database. Despite the hacker’s reference to an “Anonymous Revival Project,” they’re not associated with the loose hacker collective Anonymous, they told Best, but do “want to represent the nameless struggling masses against capitalists and fascists.”
WIRED reached out to Gab for comment Friday, offering to share what we’d learned about the nature of the site’s data breach. The company’s CEO Andrew Torba responded in a public statement on the company’s blog that “reporters, who write for a publication that has written many hit pieces on Gab in the past, are in direct contact with the hacker and are essentially assisting the hacker in his efforts to smear our business and hurt you, our users.” (WIRED has had no direct contact with the hackers, to our knowledge, only DDoSecrets.)
Responding to WIRED’s mention of a SQL injection vulnerability, Torba’s initial statement noted that “we were aware of a vulnerability in this area and patched it last week. We are also proceeding to undertake a full security audit.” The post went on to state that Gab doesn’t collect personally identifiable information from its users such as telephone numbers, Social Security numbers, birth dates, or health and financial information. “DMs were only live for a few weeks and are not currently a feature supported by the site, so if a breach has in fact occurred in that domain we expect the number of affected accounts to be low,” Torba added. “As we learn more about this alleged breach, we will notify the community publicly with our findings as required by law.”