A hacker appears to have stolen 70GBs of data from Gab, a social network home to many Trump supporters.
On Sunday, an activist group called Distributed Denial of Secrets reported it had obtained the data from an anti-Trump hacktivist out to expose the right-wing users on the platform.
The 70GBs of data includes 40 million public and private posts made on Gab, in addition to private messages and hashed passwords from users on the social network.
According to Wired, the hacktivist “JaXpArO” uncovered a SQL injection bug in Gab’s website, which allowed them to make queries and then siphon the information from the social network’s database.
Distributed Denial of Secrets is now circulating the 70GBs of data, but only to researchers and journalists in a redacted form. (For example, all hashed passwords and personally identifiable information has been removed.) The group says the leaked database will help the public better understand the online organizing on social media that led pro-Trump supporters to storm the US Capitol on January 6th.
"It's another gold mine of research for people looking at militias, neo-Nazis, the far right, QAnon, and everything surrounding January 6,” Emma Best, a cofounder of Distributed Denial of Secrets, told Wired in an interview.
Gab initially tried to downplay the breach. On Friday, the site’s founder Andrew Torba claimed his company was aware of the SQL injection vulnerability, and that the software bug had been patched. At the same time, he pointed out how hashing can essentially scramble a user’s password information.
“Gab collects very little from our users in terms of personal information. It is entirely possible for a user of the site to be unidentifiable based on the information they provide at login,” he wrote in his post.
But on Sunday, Torba changed his tone, and claimed “demon hackers” had attacked Gab. “My account and Trump’s account were compromised,” he wrote as the Conservative Political Action Conference took place on the same day. “The entire company is all hands investigating what happened and working to trace and patch the problem,” he added.
In the meantime, Best claims the SQL injection vulnerability remains unpatched over Gab's platform.