LiveAuctioneers Exposes 3.38 Million User Records in 2020 Data Breach
What Happened
In June 2020 the online antiques marketplace LiveAuctioneers suffered a breach that released 3,385,862 user records. The data set, later sold and widely redistributed, contained personal identifiers, contact information, and passwords stored as unsalted MD5 hashes.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of weak credential storage; a continuous control‑assurance program would flag unsalted hash usage during regular configuration reviews.
- Highlights the need for documented data‑classification and encryption controls—key evidence points for GDPR, CCPA, and PCI‑DSS audit trails.
- Underlines the importance of third‑party breach‑notification processes; a mature trust‑operations framework ensures timely incident disclosure and evidence collection.
Who Is Affected
- Online marketplaces & e‑commerce platforms
- SaaS providers handling consumer‑level personally identifiable information (PII)
- Companies subject to data‑privacy regulations (e.g., GDPR, CCPA)
Recommended Actions
- Inventory all integrations with LiveAuctioneers or similar auction‑service APIs and assess data flow.
- Verify that password storage follows industry‑accepted practices (salted, adaptive hashing).
- Confirm that continuous monitoring alerts on anomalous credential‑dump activity.
- Request a formal incident‑response report from the vendor and update your breach‑response playbook.
Technical Notes
- Attack vector: Likely unauthorized access to backend database; exact method not disclosed.
- CVEs: None reported in public sources.
- Data types exposed: Email addresses, IP addresses, full names, passwords (unsalted MD5), phone numbers, physical addresses, usernames.
Source: https://haveibeenpwned.com/api/v3/breach/LiveAuctioneers