Utah Gun Exchange

We noticed a significant data leak surfacing on a well-known cybercrime forum on July 17, 2020, originating from the Utah Gun Exchange. What struck us immediately was the sheer volume of personally identifiable information (PII) compromised, exceeding 235,000 records. The inclusion of not just basic contact details but also password hashes and IP addresses presents a multifaceted risk profile for the affected user base. This incident underscores the persistent vulnerabilities in managing user credentials and the downstream implications of compromised databases.

The Utah Gun Exchange breach, discovered on July 17, 2020, involved a database compromise that exposed the personal information of 235,046 individuals. The leaked data includes email addresses, username, first name, last name, gender, and IP addresses. Crucially, the breach also contained bcrypt hashed passwords, which, while not plaintext, can still be vulnerable to brute-force attacks and credential stuffing if weak hashing practices were employed or if common password patterns are used. The source structure of the leak appears to be a direct dump of user account information, likely exfiltrated from the primary Utah Gun Exchange database and potentially other affiliated sites. The leak locations were initially identified on a prominent cybercrime forum, indicating an intent for widespread dissemination and potential monetization.

External Context

While direct mainstream news coverage of this specific Utah Gun Exchange breach was limited at the time of its discovery, similar incidents involving online marketplaces and forums frequently garner attention. The nature of the data exposed – PII and hashed credentials – aligns with common threat actor objectives, often seen in campaigns targeting users of such platforms for phishing, identity theft, or further network intrusion attempts. Research into password hashing vulnerabilities and the common practices of cybercrime forums confirms that such dumps are regularly traded and exploited.