HackingRetail & ConsumerRetailStolen CredentialsPhishingSupply Chain (3P Vendor)Data ExfiltratedMulti-Stage ChainIdentity (basic)CredentialsAuthenticationMediumContained

LIVE AUCTIONEERS

bd_f184d059d1ebe760 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 11, 2020

Filed

Sep 3, 2020

To disclose

8 weeks

Affected

38,523state residents only

Confidence

70%

Full breach record for LIVE AUCTIONEERS →2 incidents on file

LiveAuctioneers notified Washington AG of a breach affecting 38,523 residents. An unknown hacker exploited a third-party software solution on June 19, 2020, to access the production database via stolen internal credentials. Usernames, hashed passwords (later decrypted), names, emails, and contact details were exposed. LiveAuctioneers notified users starting July 11, 2020, and engaged forensic consultants and the FBI.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d8 weeks discovery → filing

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

undetected · 22 days

discovery → filing · 8 weeks / 54 days

Jun 19, 2020

Begins

Jul 11, 2020

Discovered

Sep 3, 2020

Filed

vs. sector median

on median

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed38,523 affectedView incident

Name: LIVE AUCTIONEERS
norm: live auctioneers
Domain: liveauctioneers.com

Name: LIVE AUCTIONEERS
norm: live auctioneers
Domain: liveauctioneers.com
Industry: Retail & Consumerllm

Discovered: Jul 11, 2020
Breach occurred: Jun 19, 2020 – Jul 11, 2020
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 11, 2020
Affected individuals: 38,523state-resident count only
Data types: Identity (basic)CredentialsAuthentication
Data elements: NameUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid AccountsT1056 Input CaptureT1071 Application Layer Protocol
Threat actor: ExternalFinancial
Regulator citations: Made incident report to FBI
Initial access: supply_chain

During the incident: Blocked the unauthorized access to bidder account information
Expired all passwords associated with user accounts immediately upon discovery
Made incident report to FBI
Engaged outside expert forensic security consultants
Engaged legal counsel
Changes made: Implemented stronger encryption protocols for passwords (PBKDF2 using SHA512)
Implementing a salt and hash password method
Expired and replaced all security tokens and access keys
Made all system access tokenized
Require 2 factor authentication for all AWS and internal systems
Analyzing and monitoring source code to address vulnerabilities
Upgrading network infrastructure (VPC flow log, restricting security group access, implementing Guard Duty IDS, implementing new WAF)
Suspended relationship with compromised IT supplier
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10283.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 3, 2020
Raw hash: e10ebf32bfafd326cfa866278365a8faa112b30de02c48c82ce0d5b0183ef911

Reporting entityLIVE AUCTIONEERS

Victim entityLIVE AUCTIONEERS

Incidentdiscovered Jul 11, 2020

Stated responseBlocked the unauthorized access to bidder account information

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com