GunAuction.com breached, leaking sensitive info for over 550,000 end users

One-sentence summary:

GunAuction.com was breached in December 2022, leaking sensitive information for over 550,000+ users and potentially allowing gun owners to be traced.

Who was involved?

GunAuction.com, threat actor, and 550,000+ GunAuction.com users.

What was the timeline?

December 3, 2022: GunAuction.com breached (Hunt, 2023).

March 2, 2023: Added to the haveibeenpwned.com database (Hunt, 2023).

March 2, 2023: CEO of GunAuction.com shares a statement with TechCrunch.com that they are investigating the incident and intend to reach out to victims soon.

What occurred?

GunAuction.com was breached late last year and the data was stored on an unprotected server by the threat actor/s. A security researcher downloaded the data and apparently blew the whistle on the breach. TechCrunch.com analyzed the data and confirmed that it matches GunAuction.com users, although questioning the age of the data (Franceschi-Bicchierai, 2023, para. 6). GunAuction.com users are pending notification per the CEO (Franceschi-Bicchierai, 2023, para. 9). The breach exposed: “customers’ full names, home addresses, email addresses, plaintext passwords and telephone numbers” and made tracing a sale possible (Franceschi-Bicchierai, 2023, para. 2).

Estimated costs:

TBA or N/A (see disclaimer)

Involved laws:

TBA or N/A (see disclaimer)

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Franceschi-Bicchierai, L. (2023, March 2). Hackers steal gun owners’ data from firearm auction website. TechCrunch.com. Retrieved March 5, 2023, from https://techcrunch.com/2023/03/02/hackers-steal-gun-owners-data-from-firearm-auction-website/

Hunt, T. (2023, March 2). Have I Been Pwned: Pwned websites. haveibeenpwned.com. Retrieved March 5, 2023, from https://haveibeenpwned.com/PwnedWebsites

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com