Guns.com Data Breach

The company's January 13, 2021 letter describes a January 11 denial-of-service attack that lasted under ten minutes and showed no indication of an attempt to compromise data. That letter does not confirm the database published later.

On March 9, 2021, an actor published a Guns.com database allegedly obtained or sold in late 2020. File inspection reported names, nearly 400,000 emails, password hashes, addresses, phones, and account dates; a separate folder contained bank details and a spreadsheet contained plaintext administrator, WordPress, MySQL, and Azure credentials. A public breach source catalogues 375,928 unique emails with names, phones, addresses, firearm purchases, partial card data, and bcrypt customer passwords. Customer bcrypt hashes and separate administrator credentials are not the same population.

January 12 is an public breach source date whose exact meaning as access chronology is unexplained. The local job processed 365,127 email lines and produced 365,126 unique emails in the live index, 10,802 below a public breach source's measure. No other fields are locally searchable.

A result cannot establish identity, Guns.com customer status, firearm interest, ownership, or purchase, product type, birth date, address, phone, card or bank data, password co-occurrence, compromise, or misuse. An authenticated customer password should be replaced where it was reused, and firearm-market, address, and financial associations must remain private.