Guntrader Data Breach Exposes 112,031 User Records Including Password Hashes
What Happened – In July 2021 the UK‑based firearms marketplace Guntrader suffered a data breach that resulted in the extraction of 112,031 user records. Exposed data includes email addresses, names, phone numbers, geographic locations, IP addresses, physical addresses and bcrypt‑hashed passwords.
Why It Matters for Trust & Control Assurance
- Highlights the risk of inadequate credential protection and the need for strong access‑control policies.
- Demonstrates why continuous monitoring of authentication and password‑storage controls is essential for a defensible audit trail.
- Provides a concrete example of a control‑objective failure that maps to multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Online marketplaces / retail e‑commerce platforms handling personal data.
Recommended Actions – Review password‑hashing algorithms, enforce multi‑factor authentication, and implement continuous monitoring of access‑control logs to generate audit‑ready evidence. Source: Have I Been Pwned – Guntrader breach
Technical Notes – The breach exposed a full set of user‑profile fields and bcrypt password hashes; the exact attack vector was not disclosed. Source: Have I Been Pwned – Guntrader breach