Utah Gun Exchange Breach Exposes 235K User Accounts and Password Hashes
What Happened — In July 2020 the Utah Gun Exchange website (and several related sites) suffered a data breach that released 235,233 unique email addresses together with usernames, genders, IP addresses and password hashes. The compromised data were later posted on public breach‑listing services.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to protect credential data – a core control objective for any continuous control‑assurance program.
- Demonstrating secure password storage, MFA enforcement and auditable access logs is essential to provide defensible evidence during audits.
- Continuous monitoring of credential‑related activity helps detect and contain similar exposures before they become public.
Who Is Affected — Retail/e‑commerce operators (specifically firearms marketplaces) and the 235 k+ users whose personal data were exposed.
Recommended Actions
- Force an immediate password reset for all accounts and enforce strong password complexity.
- Deploy multi‑factor authentication for all user logins.
- Review password‑storage mechanisms (use salted, adaptive‑hashing algorithms such as bcrypt/argon2).
- Enable and retain detailed access‑log collection for credential‑related events.
- Map these steps to the credential‑protection control objective in your framework of record to demonstrate audit readiness.
Source: Have I Been Pwned – Utah Gun Exchange breach
Technical Notes
- Breach date: July 2020; data surfaced on breach‑base.pw and were supplied to HIBP.
- Exposed data types: email addresses, usernames, genders, IP addresses, password hashes.
- No public indication of the specific attack vector; the breach was discovered via external data‑leak monitoring.
Source: HIBP API