User Data Compromised on EBay

[TallPaul]

I recently got an email from EBay directing me to change my password. The email noted the following:

Quote:

Recently, our company discovered a cyberattack on our corporate information network. This attack compromised a database containing eBay user passwords.

Here's what we know: This attack occurred between late February and early March and resulted in unauthorized access to a database of eBay users that includes customers' name, encrypted password, email address, physical address, phone number and date of birth.


That is a lot of personal information leaked out. Worse, I first found out because I happened to log on and see the password change notice. They only sent me an email about it after I changed my password and sent them an email complaining that they should have notified me by email ASAP.

 

[aquariuscsm]

I got the same email. I wonder if it`s a scam? I didn`t change my password.

 

[HTSS_TR]

Originally Posted By: aquariuscsm
I got the same email. I wonder if it`s a scam? I didn`t change my password.

Whenever I received email(s) saying anything similar to this I go to company website directly, I DID NOT click on the link in the email.

 

[aquariuscsm]

Originally Posted By: HTSS_TR
Originally Posted By: aquariuscsm
I got the same email. I wonder if it`s a scam? I didn`t change my password.

Whenever I received email(s) saying anything similar to this I go to company website directly, I DID NOT click on the link in the email.


Same here. I just delete them.

 

[simple_gifts]

Quote:

I got the same email. I wonder if it`s a scam? I didn`t change my password.


Watch the news; is is not. If you don't trust the e-mail and I don't in general, don't click, but navigate to the site in question and see for yourself.

It is on ebay's homepage.

 

[The_Jeff]

My letter read "dear user" which is usually a giveaway. My credit card people address me by my full name.

Down at the bottom they had my first name... but still, a n'er do well could match names and email addresses.

Not very professional, guys.

 

[Drew99GT]

http://time.com/110210/ebay-data-breach/

 

[TallPaul]

BBC Says:
"The slightly worrying aspect of this is that the hackers have a nice neat list of personal information, which can be used to steal identities or even help them get around other systems though password reset scams."
Article

Also an article at Forbes.

Maybe I should change my PayPal password too. They are owned by Ebay one of the articles says.

 

[aquariuscsm]

Here`s a copy and paste of my email:


IMPORTANT: PASSWORD UPDATE

Dear eBay Member,

To help ensure customers' trust and security on eBay, I am asking all eBay users to change their passwords.

Here's why: Recently, our company discovered a cyberattack on our corporate information network. This attack compromised a database containing eBay user passwords.

What's important for you to know: We have no evidence that your financial information was accessed or compromised. And your password was encrypted.

What I ask of you:
Go to eBay and change your password. Changing your password may be inconvenient. I realize that. We are doing everything we can to protect your data and changing your password is an extra precautionary step, in addition to the other security measures we have in place.

If you have only visited eBay as a guest user, we do not have a password on file.

If you used the same eBay password on any other site, I encourage you to change your password on those sites too. And if you are a PayPal user, we have no evidence that this attack affected your PayPal account or any PayPal financial information, which is encrypted and stored on a separate secure network.

Here are other steps we are taking:
As always, we have strong protections in place for both buyers and sellers in the event of any unauthorized activity on your account.
We are applying additional security to protect our customers.
We are working with law enforcement and leading security experts to aggressively investigate the matter.

Here's what we know: This attack occurred between late February and early March and resulted in unauthorized access to a database of eBay users that includes customers' name, encrypted password, email address, physical address, phone number and date of birth.

However, the file did not contain financial information. And, after conducting extensive testing and analysis of our systems, we have no evidence that any customer financial or credit card information was involved. We also have no indication of a significant spike in fraudulent activity on our site.

We apologize for any inconvenience or concern that this situation may cause you. As a global marketplace, nothing is more important to eBay than the security and trust of our customers. We know our customers have high expectations of us, and we are committed to ensuring a safe and secure online experience for you on any connected device.

Devin Wenig Signature
Devin Wenig
President, eBay Marketplaces

 

[SrDriver]

Go to the EBay web site. You will find out that you should change your password asap.

This is a real issue.

 

[AandPDan]

I never received any email from Ebay. I did change my password, after seeing it on the news.

 

[TallPaul]

Now I remember that since about February I have received several bogus messages in my spam folder that were telling me that they tried to deliver my Ebay order but missed me, then it said to please print some info, think a label or something. All links on the email went to a bad looking url. I think the hackers who got in are sending bogus email in a phishing scam to Ebay users.

 

[AandPDan]

Originally Posted By: AandPDan
I never received any email from Ebay. I did change my password, after seeing it on the news.


The email arrived this morning at 1:03 am. So glad they rushed that notification.

 

[TallPaul]

I just got another bogus notification in spam. Here it is:

Priority Mail

2:41 AM (13 hours ago)

to me
Be careful with this message. It contains content that's typically used to steal personal information. Learn more
Report this suspicious message Ignore, I trust this message
USPS.COM

Notification

Your parcel has arrived at May 20th, 2014. Courier was unable to deliver the parcel to you.

Print your label and show it in the nearest post office to get a parcel.

Print Shipping Label
Copyright 2014 USPS. All Rights Reserved.



BBC Latest News:

VIDEO: Immune children aid malaria fight
An antibody produced by children who are naturally resistant to malaria could lead to an effective vaccine for the disease, scientists report.

Facebook privacy now defaults to friends only
Facebook privacy just got a little more private.

High fashion: Mario Testino's Andes adventure
Mario Testino focuses on Peru's mountain people

Life raft still on capsized yacht
The wreckage of the yacht crewed by four UK sailors missing in the North Atlantic was found with its life raft still onboard, rescuers say.

 

[spackard]

Those parcel emails have been rolling into my spam folder for several months.

 

[bradepb]

Originally Posted By: AandPDan
I never received any email from Ebay. I did change my password, after seeing it on the news.


That's also how I found out.I dont log in to e-bay very often. Nice job notifying me flee-bay

 

[Propflux01]

Originally Posted By: aquariuscsm
Here`s a copy and paste of my email:


IMPORTANT: PASSWORD UPDATE

Dear eBay Member,

To help ensure customers' trust and security on eBay, I am asking all eBay users to change their passwords.

Here's why: Recently, our company discovered a cyberattack on our corporate information network. This attack compromised a database containing eBay user passwords.

What's important for you to know: We have no evidence that your financial information was accessed or compromised. And your password was encrypted.

What I ask of you:
Go to eBay and change your password. Changing your password may be inconvenient. I realize that. We are doing everything we can to protect your data and changing your password is an extra precautionary step, in addition to the other security measures we have in place.

If you have only visited eBay as a guest user, we do not have a password on file.

If you used the same eBay password on any other site, I encourage you to change your password on those sites too. And if you are a PayPal user, we have no evidence that this attack affected your PayPal account or any PayPal financial information, which is encrypted and stored on a separate secure network.

Here are other steps we are taking:
As always, we have strong protections in place for both buyers and sellers in the event of any unauthorized activity on your account.
We are applying additional security to protect our customers.
We are working with law enforcement and leading security experts to aggressively investigate the matter.

Here's what we know: This attack occurred between late February and early March and resulted in unauthorized access to a database of eBay users that includes customers' name, encrypted password, email address, physical address, phone number and date of birth.

However, the file did not contain financial information. And, after conducting extensive testing and analysis of our systems, we have no evidence that any customer financial or credit card information was involved. We also have no indication of a significant spike in fraudulent activity on our site.

We apologize for any inconvenience or concern that this situation may cause you. As a global marketplace, nothing is more important to eBay than the security and trust of our customers. We know our customers have high expectations of us, and we are committed to ensuring a safe and secure online experience for you on any connected device.

Devin Wenig Signature
Devin Wenig
President, eBay Marketplaces


This one actually looks legit because it directs you to go to eBay to change your passwords.

 

[97tbird]

changed our PW on the 21st when the news of this broke out.
Got the legit ebay email about 5 days later.