LiveAuctioneers has revealed that it has suffered a data breach after a data breach broker began selling 3.4 million stolen user records on a hacking forum. LiveAuctioneers is an auction site that allows people from all over the world to bid on auctions in real time. On July 10, 2020, a data breach broker began selling a database estimated to contain 3.4 million user records stolen from the LiveAuctioneers site. The data broker told BleepingComputer that the database is being sold for $2,500. The stolen data includes user email addresses, usernames, MD5 hashes, names, phone numbers, addresses, IP addresses, and social media profiles . In addition to this data, the data broker stated that the passwords of about 3 million accounts have been decrypted, while he pointed out that these passwords were also put up for sale on the hacking forum. This data is an extremely useful and powerful “weapon” in the hands of hackers , since it can be used in targeted phishing attacks but also in other forms of attacks.
On July 11, a day after the database was sold, LiveAuctioneers issued a security advisory stating that it had suffered a data breach. The advisory stated that the auction site’s data was breached on June 19, 2020, after a LiveAuctioneers data processing partner was compromised. As of July 11, 2020, cybersecurity group “CloudSEK” confirmed that an unauthorized third party had gained access to certain user data after a LiveAuctioneers data processing partner was hacked on June 19, 2020. However, the advisory clarifies that the attacker did not gain access to users’ credit card information, and the site’s bidding history does not appear to have been compromised. The information exposed in this data breach matches the data being sold on the hacking forum.
After discovering it had been breached, LiveAuctioneers disabled passwords for all accounts and asked its members to reset their passwords via the “Forgot your password”.
What should those affected by the breach do?
LiveAuctioneers users who are concerned that their personal information and data has been leaked in this breach are advised to take the following steps:
- Change their password on any site that uses the same credentials.
- When they change their password, use a unique and strong password on every site they visit. This will prevent a potential data breach on one site from affecting their account on other sites.
- Finally, users should be wary and suspicious of any phishing attacks targeting their LiveAuctioneer account membership information and eBay.
