A recent cybersecurity report mentions that a hacker managed to download and post the database of Guns.com, one of the leading online platforms for the purchase and sale of firearms; this information is now available at a hacking forum. Researchers on the Hackread platform ensure that the compromised database includes sensitive information such as administrators’ login credentials and WordPress access in plain text.
In a further and more complete analysis, specialists mention that the database includes the following information:
- User IDs
- Full names
- Phone numbers
- About 400,000 email addresses
- Hashed passwords
- Addresses
- ZIP codes
- City and state of residence of users
- Magneto ID
- Account creation date
As if that weren’t the case, one of the filtered folders includes the financial details of multiple clients, including:
- Full names
- Name of the customer’s bank
- Account type
The leak does not include the security numbers of the compromised cards.
As mentioned before, experts report that an Excel file that appears to include sensitive Guns.com login details, including WordPress, MySQL, and Azure Cloud credentials, was also leaked. Experts were unable to determine whether these credentials are recent, old, or reset because of this incident.
On the consequences that this incident could have, specialists mention that all compromised credentials provide administrator access and are available in plain text, so virtually anyone could access the compromised platforms and perform all kinds of arbitrary actions.
Moreover, the platform launched a security alert in mid-January, recognizing the incident but attributing responsibility to operators of third-party services working with Guns.com. At that time, administrators ruled out the possibility that the data on their systems could have been exposed.
This incident should be taken seriously, as confidential information from thousands of U.S. gun owners is now available on dark web platforms available to almost anyone.
Experts recommend users of this platform to stay on top of any updates on the incident, especially due to the risk of phishing attacks, SIM swap, identity fraud and electronic fraud. Experts also recommend contacting the affected company for their risk mitigation plan.
To learn more about information security risks, malware, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.