Sterling Auctions Site Up *DO NOT BID at this time*

[Fred]

In simple terms, what is the exposure to bidders of auction houses that use the Simple Auction service?

As mentioned before, what auction houses use the Simple Auction platform?

There are several auction services that are probably similar to Simple Auctions, so the assumption here is that any one of them could have had this happen to them.

[Throttlesteer]

True, and the smartest thing to do is bring everything down when you realize one of the sites has been hacked.

[sb1]

Apparently it has impacted email accounts for Simple AH clients as well. I have not been able to send or receive emails at my two brockelmanauctions.com email accounts. Anyone needing to contact me can PM me here, until they are restored.

Scott

[BRoberts]

Originally Posted by Fred

There are several auction services that are probably similar to Simple Auctions, so the assumption here is that any one of them could have had this happen to them.

This is a ridiculous assumption. True, any website or platform can be compromised. But to assume that because one auction service is "similar" to Simple Auctions that auction service is just as vulnerable is missing the point. If the people running auction platforms do things like implement proper security, have proper monitoring software and upgrade their software when they see red flags (as Simple Auctions saw throughout 2020) then it's not a case of "this could happen to anyone."

[philo98]

Ive been in contact with a few of the AH's and it seems they will be up and running this afternoon.

[swarmee]

It was mentioned on the other board that it might be illegal currently to pay ransomware extortion. So not sure if this opens up the site to federal issues.

[bobfreedman]

Originally Posted by swarmee

It was mentioned on the other board that it might be illegal currently to pay ransomware extortion. So not sure if this opens up the site to federal issues.

Only if the hackers are on the OFAC list which these people are not. We have received the key to unencrypt the files but it will take a long time to unencrypt all of the machines and nodes etc...

Bob

[swarmee]

Originally Posted by bobfreedman

Only if the hackers are on the OFAC list which these people are not. We have received the key to unencrypt the files but it will take a long time to unencrypt all of the machines and nodes etc...

Bob

Thanks; glad you're tracking it.

[UKCardGuy]

I'll be very interested to see the analysis of the vector of attack used by the hackers, which auctions sites were affected and what types of personal data was potentially exposed.

Hopefully Bob will provide clarity about what happened and which sites were affected.

Whether the hackers use thst information, or not, is immaterial. Customers should have the opportunity to manage their risks from the attack.

Personally, I can't condone paying the ransom. If someone steals the keys to my front door, I'm not going to pay them to get the keys back. I'm going to call the locksmith and move on.

If a appropriate backups existed, then there should have been no need to pay any ransom. I'll be reconsidering my patronage of any AH using SimpleAuctionSite as a result.

[drcy]

Originally Posted by swarmee

It was mentioned on the other board that it might be illegal currently to pay ransomware extortion. So not sure if this opens up the site to federal issues.

Never heard of that.

[philo98]

Originally Posted by drcy

Never heard of that.

https://home.treasury.gov/system/fil...10012020_1.pdf