Guntrader guntrader.uk Guntrader data breach: what happened and what to do
In July 2021, Guntrader, a UK firearms sales site, was breached. About 112,000 email addresses were exposed, along with names, phone numbers, IP addresses, locations and bcrypt-hashed passwords. Some records included full postal addresses.
View all 13,177 breaches- Breach date
- 17 Jul 2021
- Affected
- 112,031
- Data exposed
- Browser user agent details, Email addresses, Geographic locations, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Salutations
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In July 2021, the UK firearms marketplace Guntrader suffered a data breach. A copy of its customer database was posted online shortly afterwards. The Register reported about 111,000 users in the data. Have I Been Pwned counted 112,031 unique email addresses.
According to Guntrader, it told the Information Commissioner's Office within hours of discovering the breach and emailed affected users.
Sources checked: haveibeenpwned.com, identitytheft.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
Have I Been Pwned lists email addresses, names, phone numbers, IP addresses, geographic locations, browser user agent details and salutations. Cities were included for all users and complete postal addresses for some. Passwords were stored as bcrypt hashes, a slow scrambling method that makes them harder to crack than plain text, though weak passwords can still be guessed.
Why it matters
Because this is a firearms site, a list of names, phone numbers and addresses carries more risk than the average customer list. Expect phishing emails and text messages that use your name or mention the site. A scammer holding your phone number and email can also try to impersonate you to your mobile carrier.
If you used the same password on Guntrader and elsewhere, change it on those other accounts now.
What to do if you were in it
- 1
Change your Guntrader password and any reuse of it
Change it on every account where you used the same or a similar password. A password manager makes a unique password for each site easy.
- 2
Turn on two-factor login
Where a service offers it, add a second step to sign-in, such as an authenticator app, so a stolen password isn't enough on its own.
- 3
Expect phishing that mentions the breach
Scammers use real details to sound legitimate. The FTC advises you not to click links or call numbers in unexpected messages; contact the organization using a number from its official website instead.
- 4
Be careful with calls and texts about your mobile account
Your phone number was exposed. Don't share one-time codes with anyone who contacts you, and call your carrier on its official number if you get a message about changing your account.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan against breach databases and the dark web and alerts you if your email or phone number shows up. Serus can't remove data from a breach, but it tells you when to change a password or watch for phishing.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Guntrader breach?
You can search your email address on Have I Been Pwned, which lists 112,031 unique email addresses from the breach. Serus's free scan also checks breach databases for your email and phone.
What was exposed in the Guntrader breach?
Email addresses, names, phone numbers, IP addresses, locations, browser details and salutations, plus bcrypt-hashed passwords. Some records had full postal addresses.
Should I change my password?
Yes, if you used Guntrader's password anywhere else. Hashed passwords are harder to crack, but the FTC advises changing a leaked password and any reuse of it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
