Gunauction.com breach

[Uninformed and Compliant]

Hackers steal gun owners' data from firearm auction website

"The breach exposed reams of sensitive personal data for more than 550,000 users, including customers’ full names, home addresses, email addresses, plaintext passwords and telephone numbers. Also, the stolen data allegedly makes it possible to link a particular person with the sale or purchase of a specific weapon."

"DelaCruz added that “our intention is to inform affected users very soon.”

 

[Uninformed and Compliant]

email addresses, plaintext passwords

I'll point out that if you re-use that password in other sites, these people will simply plug-n-play your email and that password into every gun-related store they can find. Doesn't matter if it fails, it costs them nothing and only needs to succeed once.

 

[SonOfSun]

"The breach exposed .... email addresses, plaintext passwords....."

What shit site security. You never store plaintext passwords. Each user's password database field entry should be individually SALTED and then hashed, with the hash result stored instead.

I'll point out that if you re-use that password in other sites, these people will simply plug-n-play your email and that password into every gun-related store they can find. Doesn't matter if it fails, it costs them nothing and only needs to succeed once.

Not only other gun sites, but also your email itself. Can guarantee some of them used the same password for their email as well.



EDIT: For those of you that are wondering what I'm talking about: How to securely store passwords in database

 

[Bustedknees]

Very sad what's become of Auction Arms / Gun Auction. They were a great place 10 years ago but the kid really killed the place when he took over and other top management (The Cat Herder) left for retirement. I bought my first online guns over there at crook prices! No 10 or 15 minute rule back in the day so if you had a decent connection speed and fast fingers Sniping was a very fun and cheap way to close out an auction in the last seconds. They also had one Hell of a national forum with a lot of very good people and there was also enough pelting to make it plenty of fun too. Manny Jr. killed that off then brought it back but bad policies, lack of management, and no communication with his customers sent the place tanking. This new attack doesn't surprise me as the place is riddled with scam artist. Buyer and seller beware!!

 

[Bustedknees]

We are writing to you today with some concerning news. Recently, our company discovered a data breach that has potentially exposed your personal information. We wanted to take a moment to explain the situation and offer our sincerest apologies.

We recently became aware that an unauthorized individual gained access to our database. Unfortunately, this database contained your name, address, and email address. We understand how important this information is, and we want to assure you that we are taking immediate action to investigate and rectify the breach.

We are working closely with the FBI, who is investigating the matter. We want to stress that we have no reason to believe that any financial information was accessed during the breach. However, we recommend that you monitor your financial accounts and credit reports closely for any suspicious activity.

We understand how unsettling this news may be for you, and we apologize for any inconvenience or worry that it may cause. We want to assure you that we are taking all necessary steps to prevent similar incidents from happening in the future.

If law enforcement makes us aware of any more information that can be of assistance, we will notify you immediately. Again, thanks for your patience.

Manny DelaCruz
CEO/GunAuction.com

I found this on what's left of their forum page.

 

[Bustedknees]

Commander (Ret.) Robert Lee Lancaster | My Pulse News

Commander (Ret.) Robert Lee Lancaster of Mena, age 73, passed from this life on May 23, 2023, in Fort Smith, Arkansas. Bob was born on May 19, 1950, to James Lee and Leslie Genevieve Davis Lancaster in Denver, CO. The Lancasters moved to Yocana in 1958. Bob attended Cherry Hill Elementary School...

mypulsenews.com

When Bob ran this company it was one of the best .

 

[Keyzard]

I'll point out that if you re-use that password in other sites, these people will simply plug-n-play your email and that password into every gun-related store they can find. Doesn't matter if it fails, it costs them nothing and only needs to succeed once.

Use a password manager that can generate strong passwords for you. I have over 600 logins stored in Bitwarden and there is not one duplicate. It took a bit of effort to get there, but I started with my most used sites and then set a goal of changing 10 every morning until they were all done.

You can set options for the passwords that are generated. I use at least 15 characters and symbols. For example - "G7V@Rm#gBsnxP7B"

 

[lrick]

We are working closely with the FBI, who is investigating the matter.

Also, the stolen data allegedly makes it possible to link a particular person with the sale or purchase of a specific weapon."

It sure as hell will be now