LiveAuctioneers liveauctioneers.com LiveAuctioneers data breach: what happened and what to do
In June 2020 the online auction marketplace LiveAuctioneers had a data breach that exposed about 3.4 million records: names, email and IP addresses, physical addresses, phone numbers and passwords stored as unsalted MD5 hashes.
View all 13,115 breaches- Breach date
- 19 Jun 2020
- Affected
- 3,385,862
- Data exposed
- Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
LiveAuctioneers, an online marketplace for antiques and collectibles, had a data breach in June 2020. Have I Been Pwned (HIBP) lists about 3.4 million records from it.
What happened
The data was sold online and then spread widely. LiveAuctioneers said the intrusion went through a third-party partner's systems, and it required customers to set a new password when they next signed in. The company said not every account had every type of data.
What was exposed
HIBP says the records included names, email addresses, IP addresses, physical addresses, phone numbers and usernames. Passwords were stored as unsalted MD5 hashes, a weak method that makes many passwords quick to crack, especially short or common ones.
What it means for you
If you had a LiveAuctioneers account in 2020, assume the password could be known. Anyone who reuses it elsewhere is exposed there too. The mix of name, address and phone number also makes phishing and scam calls about auction purchases easier to make convincing.
Bank card details were not part of the HIBP data.
How to check your exposure
Search your email address on Have I Been Pwned, which holds this dataset and lets you look up an address for free. If you find it there, change the password on any account that shared it, then watch your inbox for messages about auction wins, payments or shipping that you didn't expect.
What to do if you were in it
- 1
Change your password and turn on 2FA
Set a new, unique password for LiveAuctioneers. If you used that password anywhere else, change it there too, and turn on two-factor login on your important accounts. A password manager makes unique passwords easy.
- 2
Expect phishing and text scams that mention the breach
Treat unexpected emails, calls and texts that use your name, phone number or address with suspicion. Don't click links in them. Go to the company's site by typing the address yourself.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures early. It can't remove data from a breach, which is why the steps above matter.
Frequently asked
Was I affected by the LiveAuctioneers breach?
Search your email on Have I Been Pwned. If it lists LiveAuctioneers, your address was in the data. A free Serus scan also checks other breaches.
What was exposed in the LiveAuctioneers breach?
Names, email and IP addresses, physical addresses, phone numbers, usernames and passwords stored as unsalted MD5 hashes.
Should I change my password?
Yes, if you used LiveAuctioneers in or before 2020, and on any site where you reused that password.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
