GunAuction.com Data Breach

TechCrunch tested a sample, ten contacted people confirmed their records, and CEO Manny DelaCruz said the FBI had contacted the company about a possible breach. The age of the data was unclear, and many contact addresses or phones no longer worked.

Direct inspection found full names, home addresses, emails, plaintext passwords, and phones and showed that some records could be linked to a particular firearm listing or sale. A public breach source additionally catalogues user-agent details, gender, IPs, partial birth dates, card type or partial card data, and usernames. The CEO acknowledged likely name, address, and email exposure but said the company had no reason to believe financial information was accessed; full card numbers and CVVs are not established.

A public breach source's 565,470 figure is a dataset-record measure, not unique people, accounts, firearm owners, buyers, or sellers. The December 3 catalogue or dataset date, researcher discovery in late 2022, and March 2023 report are separate milestones. No dataset or searchable person-level data exists locally.

The record does not identify anyone as a firearm owner, buyer, seller, or current resident of an address; field co-occurrence and a specific listing link cannot be assumed for every record. A plaintext password should be replaced where it was reused. Address, contact, and marketplace associations require the strictest private handling, and unexpected contact should be verified independently.