Gunauction.com data breech

[Mytmoss]

It seems that gunuction.com had a serious data breech in December. I went there to change my password and evidently they knew about it because I was forced to change mine.

Per the update I got from I received from a monitor I have the following are at risk

Passwords

Partial credit card data

IP addresses

Phone numbers

Email addresses

Physical addresses

Additional information, including:

Browser user agent details, Genders, Partial dates of birth, Usernames

I suggest that if you have used the password you used there for any other sites you change them immediately.

[The Gleam]

It seems that gunauction.com had a serious data breech in December.

Poorly run site, with piss-poor security - and essentially NO customer service and NO member support. Your only recourse for contact is to send a text-message to a phone number and MAYBE you'll get a reply after several days or weeks.

This is their third major security breach with loss of significant amounts and very sensitive data.

Manny is too damned busy to be bothered apparently. His response to the hack says it all.

Or maybe he's too busy trying to add all sorts of asinine goofy graphics, 80 different fonts in 30 different font sizes, features and gimmicks, stupid crap like 'The Game' all while he has neglected addressing the most important concern of the site and its reliability to not fubar auctions mid-bidding.

Meanwhile, once high-volume and reliable sellers have left the site in droves. At this time, there is only ONE single seller on there in all of California, with only 4 items up for auction - it's gotten that bad!

And because they never extinguish or remove their completed auction-sale history from their servers/archives, even after 2 decades, while taking it upon themselves to update your feedback involuntarily to create a running history list of the guns and items you purchased for anyone to see, whether you wanted to have that recorded or not, now someone has all your private information and a shopping list of whatever guns you bought over the last 23 years through their site.

Gunbroker only holds completed auction information for 90 days, then deletes it - which is the approach that should be taken.

I stopped buying anything on Gunauction.com more than 6 years ago, not only because 5 of their top local CA sellers from whom I liked to buy ALSO ditched and dumped Gunauction.com, due to constant repeat hassles, problems, their buggy site, and lousy customer service (actually, lacking any at all) - but also because of the issues above.

No thanks.

Luckily, I never entered any financial information, nor any accurate name or address, nor any personal info and my email address used for that site is a nonsensical throwaway, since the very beginning - because I only ever needed to provide my real information directly to the sellers outside of the site and in-person to complete a purchase. I always suspected something like this could happen.

But I suppose if someone captured IP info and were savvy, they could figure out actual identity with minimal research.

Read about it here:

Hackers Steal Gun Owners’ Data from Firearm Auction Website (GunAuction.com, formerly AuctionArms.com )

https://techcrunch.com/2023/03/02/ha...ction-website/

The breach exposed reams of sensitive personal data for more than 550,000 users, including customers’ full names, home addresses, email addresses, plaintext passwords and telephone numbers. Also, the stolen data allegedly makes it possible to link a particular person with the sale or purchase of a specific weapon.

“With this data, you can then take a public listing…and resolve it back to the [data in the stolen database] so you have the name, email and physical address and phone number of [the seller] and presumably, the location of the gun,” Troy Hunt, a cybersecurity expert who runs the popular data breach repository and alerting service Have I BeenPwned, told TechCrunch.

/////

What he found was data taken from the website GunAuction.com, a site that since 1998 allows people to put guns for auction online.

/////

GunAuction.com CEO Manny DelaCruz confirmed the breach in an email.

“I can confirm that we were recently contacted by the FBI regarding the possibility of a data breach that has affected our company,” DelaCruz wrote in the statement.

“The breach likely exposed personal customer information like names, addresses, and email addresses. However, we want to reassure our customers that we have no reason to believe that any financial information was accessed during the breach. We are advising our customers to remain vigilant and monitor their financial accounts and credit reports for any suspicious activity.”

DelaCruz added that “our intention is to inform affected users very soon.”

Very soon Manny? He has yet to do that. What an asschump.


---

[The Gleam]

Still no notice to users.

Despicable.
---

[CALI-gula]

Thanks. Just changed all my info. Lucky I never had credit card or real address in there. Used a nickname instead of real name. Still sucks though.




.

[The Gleam]

Manny still acting like it never happened.

Moving from negligence in lousy security protocols to criminal handling of the situation by not notifying users who's information has been compromised.

---