Breach Disclosure: LiveAuctioneers

LiveAuctioneers, a popular online antiques marketplace, was breached in June 2020, impacting over 3.4 million user records. This breach was posted by ShinyHunters on a popular hacking forum in July 2020 and is available for sale at a minimal price.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

LiveAuctioneers is a worldwide online marketplace that hosts thousands of auctions, allowing unprecedented access to remote sales. In July 2020, a threat actor posted the LiveAuctioneers leak on the dark web, stating that the leak impacts over 3.4 million users.

Figure 1. LiveAuctioneers Database available for sale on a popular hacking forum.

The leaked information includes:

Names Email addresses IP addresses Physical addresses Phone numbers Passwords (stored as unsalted MD5 hashes)