Breach Disclosure: Guntrader

Breach Disclosure: Guntrader

On July 16, 2021, United Kingdom-based firearm retailer, Guntrader, suffered a data breach that resulted in the compromise of 112,000 account records. The breached details included user email addresses, names, geolocation data, and bcrypt password hashes. Website users received an apology email from the Guntrader founder, disclosing the breach and clarifying that the threat actor obtained encrypted passwords and that financial information was not included in the compromised database.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

The information obtained from Guntrader was published on a cybercriminal underground marketplace by an actor using the alias "AXIL0-0." The advertisement for the data leak was published for free with details on the number of records included in the data set and links for downloading the breach package. The "EnglishShooting" Facebook page obtained a sample of the advertisement, displayed in Figure 1.

Figure 1: Actor "AXIL0-0" published a thread on a marketplace forum advertising the sale of a Guntrader data breach package (Source: Fieldsports Channel)