Ge.tt Data Breach (2017): What Was Exposed & What To Do

In May 2017 the file-sharing platform Ge.tt suffered a data breach that affected records associated with roughly 2.5 million users. The incident remained largely unnoticed by the public until February 2019, when the data set appeared for sale on a dark-web marketplace together with other breach collections. The exposed records included email addresses, names, SHA256 password hashes and social-media profile identifiers.

Breaking down the breach

The breach was first reported on 4 May 2017. Public records state that the incident involved almost 2.5 million unique email addresses along with associated names, social-media profile identifiers and SHA256 password hashes. No information has been released about the method of intrusion, the precise date the access occurred, or the number of files or records ultimately taken. The data later surfaced for sale nearly two years after the initial report.

How a breach like this happens

Incidents involving file-sharing services commonly begin with attackers obtaining unauthorised access to user databases. This can occur through exploitation of unpatched software, weak or reused credentials on administrative systems, or misconfigured storage that leaves data reachable from the public internet. Once inside, an attacker may copy tables containing account details and later attempt to monetise the collection by offering it on underground forums. The interval between the initial intrusion and the public appearance of the data can span months or years, making early detection difficult for both the organisation and its users.

About Ge.tt

Ge.tt operated as an online file-sharing service that allowed users to upload and distribute documents and media through simple links. Services of this type maintain accounts tied to email addresses and often store names and password credentials to manage access and sharing permissions. They may also record links to external social-media profiles when users choose to connect those accounts. A breach at such a platform is consequential because the data can be used to target individuals across multiple online services rather than remaining confined to a single site.

The information in question

The records reported as exposed include email addresses, names, SHA256 password hashes and social-media profile identifiers. The exact scope of additional fields, if any, has not been disclosed. Organisations that provide file-sharing accounts routinely hold these categories of data to authenticate users and facilitate sharing, yet the precise contents of the Ge.tt data set remain limited to the types listed in public reports.

Why it matters

Email addresses combined with password hashes can enable attackers to test credentials on other websites, especially where users have reused passwords. Names and social-media identifiers add context that can support targeted phishing or account-recovery attempts. For the organisation, the incident highlights the long-term value attackers place on even dated user data and the difficulty of containing exposure once records leave the original environment. Affected individuals face these risks without any confirmed timeline for when the data first left Ge.tt’s control.

Were you affected?

Individuals can check whether their email address appears in known breach data sets by using a free exposure-scanning service that queries public breach repositories. If matches are found, the recommended first steps are to change passwords on any accounts that share the affected credentials, enable multi-factor authentication where available, and monitor for unusual login activity. Organisations that have not already notified users should still be contacted directly for any additional guidance they may provide.

AICompiled with AI assistance from public sources and published under our editorial standards.