GunAuction.com gunauction.com GunAuction.com data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In December 2022, data on over 565,000 GunAuction.com users was found unprotected on a hacker's server. It included names, email and physical addresses, phone numbers and plain text passwords. Records could be matched to firearms listed for sale on the site.
View all 13,118 breaches- Breach date
- 3 Dec 2022
- Affected
- 565,470
- Data exposed
- Browser user agent details, Email addresses, Genders, IP addresses, Partial credit card data, Partial dates of birth, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
GunAuction.com is an online firearms auction site. In December 2022 it suffered a data breach, and the data was later found sitting unprotected on the hacker's server. Have I Been Pwned counts over 565k user records. TechCrunch reported on it in March 2023, and said the company's CEO told the outlet that the FBI had contacted him about the possible breach.
Sources checked: haveibeenpwned.com, techcrunch.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The records held email, IP and physical addresses, names, phone numbers, genders, years of birth, credit card type and passwords stored in plain text. Have I Been Pwned also lists browser user agent details and usernames. The company's CEO said there was no reason to believe full financial information was accessed.
Why this one is sensitive
Have I Been Pwned notes that the leaked identities could be matched to firearms listed for sale on the site. That ties a person's home address to the fact that they own or sell firearms. It raises two risks beyond the usual spam: targeted scams aimed at gun owners, and the chance that someone knows where valuable items are kept. If you sold or bought on the site, take the physical side seriously as well as the online one.
What to do
Passwords were stored in plain text, so change that password anywhere you reused it. Expect phishing that mentions firearms or auctions, and be careful with any unexpected call or visit.
What to do if you were in it
- 1
Change the password, and every place you reused it
Change it on this site first, then on any account that used the same or a similar password. A password manager makes unique passwords easy. Start with your email account, because password resets for other accounts usually go there.
- 2
Turn on two-factor login
Use an authenticator app or passkey where the site offers one. It stops most account takeovers even when a password is already out there.
- 3
Expect phishing that mentions the breach
Scammers use leaked details like your address, phone number or what you listed for sale to sound convincing, and the FTC warns that they may pretend to be the breached company. Don't click links in messages about it. Contact the company through a phone number or website you already know. The FTC's breach guidance explains what to look for.
- 4
Review your physical security
If you listed firearms on the site, assume your address could be linked to them. Check that storage and home security are sound. If someone threatens or targets you, report it to local police.
- 5
Watch your card statements
The records included credit card type, not full card details. Still, check statements for charges you don't recognize and report them to your card issuer. The FTC has more on acting on breach notices.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps monitoring and alerts you when they show up in a new leak. It can't remove data from a breach, so the other steps still matter.
Frequently asked
Was I affected by the GunAuction.com breach?
Search your email on Have I Been Pwned, which holds this breach. If you had an account on GunAuction.com around 2022, assume your record was in the data.
What was exposed?
Names, email and physical addresses, phone numbers, IP addresses, genders, partial dates of birth, partial credit card data, usernames and passwords stored in plain text.
Should I change my password?
Yes. Passwords were stored in plain text, so anyone with the data could read them. Change it everywhere you used it.
Can the data be linked to firearms?
According to Have I Been Pwned, the leaked identities could be matched to firearms listed for sale on the website.
Sources
- Have I Been Pwned: GunAuction
- Have I Been Pwned: GunAuction.com Data Breach · haveibeenpwned.com
- Hackers steal gun owners' data from firearm auction website · techcrunch.com
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- IdentityTheft.gov · identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
