An examination of the 65GB of hacked data from Gab finds that only 1.5M of the total 4M+ Gab accounts in the repository have posted content to the site
Micah Lee / The Intercept : Tweets: @micahflee , @3r1ng , @3r1ng , @theintercept , @quinncy , @natsecgeek , and @3r1ng Tweets: Micah / @micahflee : Inside @getongab, the Online Safe Space for Far-Right Extremists https://theintercept.com/... Last month Gab was hacked. I examined the ~65gb of the hacked data. Here's a broad overview of what I found Erin Gallagher / @3r1ng : Public & private Gab groups created from Dec 2020 to Feb 2021. The big wave after Jan 8 is the Parler exodus. On December 22 someone made 46 private groups for chapters of the Oath Keepers, that's the smaller spike in December 2020: https://theintercept.com/... https://twitter.com/... Erin Gallagher / @3r1ng : The last two years of anti-Semitic, anti-Black, anti-LGBTQ+, and anti-trans slurs used in Gab posts via @theintercept: https://theintercept.com/... https://twitter.com/... @theintercept : 4 million accounts on social media site Gab were hacked, including the verified account of QAnon supporter Rep. Marjorie Taylor Greene. https://theintercept.com/... Quinn Cummings / @quinncy : “Everything is covered in dried jizz.” The rest is commentary. https://twitter.com/... @natsecgeek : Gab only has 100k active users https://theintercept.com/... https://twitter.com/... Erin Gallagher / @3r1ng : “The hacked data from Gab contains 65 gigabytes of data, including 4 million Gab accounts, 31,000 groups, and 39 million posts.” - @micahflee: https://theintercept.com/... Only 1.5 M accounts actually posted, only 400K posted 10+ times. 100K accounts posted 10+ times since 12/1/20.
Context & Ripple Effects
The Intercept's analysis lands two weeks after DDoSecrets announced the breach and began distributing the 70GB dump, turning raw stolen data into the first independent audit of Gab's actual usage. The arc here runs back to Gab's origins: the site held just 98K accounts when profiled as a far-right haven at launch in 2016, then rode a near-200% traffic surge in early 2019 — but headline account counts were always the metric anyone cited.
The leaked dataset finally separates registration from participation: of 4M+ accounts, only 1.5M have ever posted, and researcher Erin Gallagher's group data shows the biggest creation wave came from the Parler exodus after January 8, not organic growth. For a platform funded through StartEngine crowdfunding rounds under the Jobs Act exemption, the gap between claimed and active users is a material fact.
First-order effects
- Gab's 4M-account figure stops functioning as an engagement claim — press and researchers can now cite that only 400K accounts posted 10+ times and just 100K have been active since December 1, 2020.
- Every one of those accounts now has passwords and private posts circulating publicly, exposing individual Gab users to doxxing and credential reuse attacks regardless of how inactive they were.
Second-order effects
- Rivals competing for the same 'censorship-free' niche — Parler, whose own scale has been measured at roughly 50,000 daily active users — face the same scrutiny, since the Gab data gives analysts a template for auditing signup-versus-activity ratios across alt-platforms.
- Gab's future fundraising via small-dollar equity crowdfunding depends on growth narratives, so a documentedly hollow active base pressures its pitch to retail investors more than any single moderation controversy has.
Third-order effects
- Fringe social networks are increasingly measured not by their own dashboards but by hostile leaks and third-party forensics, making breach-driven transparency a de facto accountability mechanism for platforms that reject outside audit.
- If the pattern holds, investor and press attention to alt-platforms shifts from total registrations to verified active-poster counts, structurally repricing what a 'censorship-free' audience is worth.
The trend: Alternative social platforms are being sized by forensic outsiders rather than their own metrics, as leaks replace self-reported user counts as the measure of whether these networks are real communities or empty registries.