Cyber Incident Victim: LiveAuctioneers
Date:
Jun 2020
Location:
United States of America
Summary
LiveAuctioneers experienced a data breach via unauthorized access through a data processing partner, resulting in the theft of approximately 3.4 million user records containing email addresses, usernames, MD5-hashed passwords, names, phone numbers, physical addresses, IP addresses, and social media profiles. The compromised data, later sold on a hacker forum, included decrypted passwords for 3 million accounts and was verified by a cybersecurity firm to match samples of U.S. and U.K. user information. The company responded by forcing password resets for all users and advising heightened vigilance against phishing attempts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
LiveAuctioneers disclosed a data breach on July 11, 2020, following the discovery of 3.4 million stolen user records being sold on a hacker forum. The unauthorized access occurred on June 19, 2020, through a third-party data processing partner. The compromised data included email addresses, usernames, MD5 hashed passwords, full names, phone numbers, physical addresses, IP addresses, and linked social media profiles. A cybersecurity firm, CloudSEK, independently verified the authenticity of the dataset by cross-referencing sample records with known U.S. and U.K. user information. The breach broker additionally claimed to have decrypted passwords for 3 million accounts, which were included in the sale. This exposure created significant risks for credential-stuffing attacks and identity theft across other platforms where users might have reused passwords.
Upon confirming the breach, LiveAuctioneers immediately disabled all user account passwords and enforced mandatory resets to invalidate compromised credentials. The company publicly advised affected users to change passwords for all online accounts and remain alert to potential phishing attempts leveraging the stolen personal information. The timeline of events indicates a 22-day gap between the intrusion and public disclosure. Forensic analysis confirmed that the data sold on the hacker forum matched the records exfiltrated from LiveAuctioneers’ systems. No evidence suggested ongoing unauthorized access after the initial breach. The incident highlighted supply-chain vulnerabilities through third-party vendors while impacting users across multiple geographic regions, with CloudSEK’s verification specifically confirming U.S. and U.K. victim data in their sample analysis.