GunAuction.com data breach: 565K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2023-03-02
In December 2022, the online firearms auction website GunAuction.com suffered a data breach which was later discovered left unprotected on the hacker's server. The data included over 565k user records with extensive personal data including email, IP and physical addresses, names, phone numbers, genders, years of birth, credit card type and passwords stored in plain text. The leaked identities could subsequently be matched to firearms listed for sale on the website. Exposed data: browser user agent details, email addresses, genders, ip addresses, partial credit card data, partial dates of birth, passwords, phone numbers, physical addresses, usernames. The breach dates from Dec 3, 2022; Have I Been Pwned loaded it on Mar 2, 2023.
What to do
- If you had a GunAuction.com account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
