# Ebay security breach - they are requesting that all users change their passwords ASAP. **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [May 21, 2014, 2:54pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929 "2014-05-21T14:54:59Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![JohnT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnt/32/15048_2.png) [@JohnT](https://boards.straightdope.com/u/JohnT)\ **Post date:** [May 21, 2014, 2:54pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/1 "2014-05-21T14:54:59Z")
> **[Change Your eBay Password Now](https://www.businessinsider.com/ebay-paypal-password-changes-2014-5)** > > eBay asked all users to change their passwords > [@](#): > > eBay is asking all users to change their passwords because of a cyberattack. It says that the attack compromised passwords and other nonfinancial data. > > Cyberattackers reportedly used employee credentials to gain unauthorized access to eBay’s corporate network and a database that contained customers’ names, encrypted passwords, email addresses, physical addresses, phone numbers, and dates of birth. Shit. I actually have an ebay account. Oh, well. ---
**Author:** ![chiroptera](https://avatars.discourse-cdn.com/v4/letter/c/df705f/32.png) [@chiroptera](https://boards.straightdope.com/u/chiroptera)\ **Post date:** [May 21, 2014, 2:57pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/2 "2014-05-21T14:57:40Z")
I saw that this morning and changed my eBay password. ---
**Author:** ![kayaker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kayaker/32/441_2.png) [@kayaker](https://boards.straightdope.com/u/kayaker)\ **Post date:** [May 21, 2014, 3:34pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/3 "2014-05-21T15:34:26Z")
I have an eBay account but haven’t accessed it in a few years. Screw it. And them. I don’t see why I should attempt to log-in, probably having to reset my password, in order to change my password. ---
**Author:** ![VinylTurnip](https://avatars.discourse-cdn.com/v4/letter/v/b2d939/32.png) [@VinylTurnip](https://boards.straightdope.com/u/VinylTurnip)\ **Post date:** [May 21, 2014, 5:31pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/4 "2014-05-21T17:31:17Z")
Hey, I don’t remember bidding $55 million on a Hummel figurine! ---
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [May 21, 2014, 5:37pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/5 "2014-05-21T17:37:42Z")
This is my chance to buy that Marilyn Monroe/Venus de Milo mash-up lamp I’ve been wanting for the living room and tell my wife it must have been eBay hackers. ---
**Author:** ![Sean\_Factotum](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Sean\_Factotum](https://boards.straightdope.com/u/Sean_Factotum)\ **Post date:** [May 21, 2014, 5:44pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/6 "2014-05-21T17:44:31Z")
> [@Jophiel](#): > > This is my chance to buy that Marilyn Monroe/Venus de Milo mash-up lamp I’ve been wanting for the living room and tell my wife it must have been eBay hackers. And then why, she’ll ask, did they ship the damn thing to us? ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [May 21, 2014, 5:46pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/7 "2014-05-21T17:46:02Z")
> [@Sean\_Factotum](#): > > And then why, she’ll ask, did they ship the damn thing to us? They were hoping to steal it off the porch before we brought it in. ---
**Author:** ![Intergalactic\_Gladiator](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/intergalactic_gladiator/32/112_2.png) [@Intergalactic\_Gladiator](https://boards.straightdope.com/u/Intergalactic_Gladiator)\ **Post date:** [May 21, 2014, 5:46pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/8 "2014-05-21T17:46:06Z")
> [@VinylTurnip](#): > > Hey, I don’t remember bidding $55 million on a Hummel figurine! Heh heh heh… ---
**Author:** ![Ethilrist](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ethilrist/32/4604_2.png) [@Ethilrist](https://boards.straightdope.com/u/Ethilrist)\ **Post date:** [May 21, 2014, 6:10pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/9 "2014-05-21T18:10:08Z")
> [@running\_coach](#): > > They were hoping to steal it off the porch before we brought it in. And the good news is, since you didn’t order it, you don’t have to pay for it. Win! ---
**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\ **Post date:** [May 21, 2014, 7:56pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/10 "2014-05-21T19:56:45Z")
> [@Jophiel](#): > > This is my chance to buy that Marilyn Monroe/Venus de Milo mash-up lamp I’ve been wanting for the living room and tell my wife it must have been eBay hackers. Really? That’s the lamp you want? Not [this](https://www.google.com/search?q=lamp+from+christmas+story&client=firefox-a&hs=4dt&rls=org.mozilla:en-US:official&channel=sb&tbm=isch&tbo=u&source=univ&sa=X&ei=TwR9U7z4JIKIqgbtgoKICQ&ved=0CE8QsAQ&biw=1680&bih=921) one? ---
**Author:** ![seal\_cleaner](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@seal\_cleaner](https://boards.straightdope.com/u/seal_cleaner)\ **Post date:** [May 22, 2014, 12:51am UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/11 "2014-05-22T00:51:55Z")
I logged in and changed my password, then was told that the credit card associated with my account had expired. Win! ---
**Author:** ![galen\_ubal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/galen_ubal/32/4440_2.png) [@galen\_ubal](https://boards.straightdope.com/u/galen_ubal)\ **Post date:** [May 22, 2014, 2:27am UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/12 "2014-05-22T02:27:29Z")
Saw it, and changed my password. As I was looking at the password requirements, I was thinking that it doesn’t need to be some agglomeration of letters and numbers - it doesn’t matter _what_ my password is, some hacker is just going to break into their system and get it anyway! Might as well just use “123456”\* \*No, that’s not my password for anything. ---
**Author:** ![Deeg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/deeg/32/2955_2.png) [@Deeg](https://boards.straightdope.com/u/Deeg)\ **Post date:** [May 22, 2014, 3:33am UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/13 "2014-05-22T03:33:10Z")
Thanks for the heads up JohnT. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [May 22, 2014, 3:57am UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/14 "2014-05-22T03:57:01Z")
Great, I’m glad someone started this thread. Did anyone get any notification from eBay? I haven’t. My eBay password was too insecure anyway. Actually, does eBay store credit card information? I thought only PayPal does that. They said the breach occurred in Feb-Mar, and they only just found out! I’d think the damage has been done. ---
**Author:** ![Rick\_Kitchen](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rick_kitchen/32/522_2.png) [@Rick\_Kitchen](https://boards.straightdope.com/u/Rick_Kitchen)\ **Post date:** [May 22, 2014, 5:12am UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/15 "2014-05-22T05:12:32Z")
I wonder if there’s a problem with PayPal. But I don’t remember my passwords for either one. ---
**Author:** ![Gus\_Gusterson](https://avatars.discourse-cdn.com/v4/letter/g/85f322/32.png) [@Gus\_Gusterson](https://boards.straightdope.com/u/Gus_Gusterson)\ **Post date:** [May 22, 2014, 3:33pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/16 "2014-05-22T15:33:41Z")
According to an SEC filing filed yesterday, they were to begin notifying users by email “later today” (so it should have started by now). I haven’t gotten a notification yet. ---
**Author:** ![galen\_ubal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/galen_ubal/32/4440_2.png) [@galen\_ubal](https://boards.straightdope.com/u/galen_ubal)\ **Post date:** [May 22, 2014, 11:16pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/17 "2014-05-22T23:16:43Z")
In [this article](http://windowsitpro.com/paul-thurrotts-wininfo/after-ebay-hack-call-change-passwords), it’s mentioned that they’re investigating the breach. > [@](#): > > Further, eBay says it has the Mandiant forensics division at FireEye to help it figure out exactly what happened. But an early investigation reveals that human error, as always, was at the heart of the exploit:\* The hackers gained login credentials for a “small number” of eBay employees\* and then used that access for their attack. Emphasis mine. _sigh_ ---
**Author:** ![Rachellelogram](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rachellelogram/32/8689_2.png) [@Rachellelogram](https://boards.straightdope.com/u/Rachellelogram)\ **Post date:** [May 22, 2014, 11:40pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/18 "2014-05-22T23:40:59Z")
> [@galen\_ubal](#): > > Saw it, and changed my password. > > As I was looking at the password requirements, I was thinking that it doesn’t need to be some agglomeration of letters and numbers - it doesn’t matter _what_ my password is, some hacker is just going to break into their system and get it anyway! Might as well just use “123456”\* > > \*No, that’s not my password for anything. I have the same thing on my matched luggage! ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [May 23, 2014, 7:48am UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/19 "2014-05-23T07:48:09Z")
Ok phishers are capitalising by sending out password reset emails with phishing links. That’s actually quite smart. [https://www.facebook.com/eBay/posts/10152893732898136](https://www.facebook.com/eBay/posts/10152893732898136) “Don’t be fooled: The authentic eBay password reset email will not have any embedded links. If you get an unsolicited email that appears to be from eBay that does contain links, DO NOT CLICK but instead DELETE, as it could be a phishing attempt. You can reset now at [eBay.com](http://eBay.com).” Also, eBay’s password reset method is… unorthodox. There’s no password reset page. You have to give them your user ID or email, and they’ll send you a reset link. It’s like they only have a forgotten password reset. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [May 23, 2014, 12:56pm UTC](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929/20 "2014-05-23T12:56:31Z")
> [@AaronX](#): > > Also, eBay’s password reset method is… unorthodox. There’s no password reset page. You have to give them your user ID or email, and they’ll send you a reset link. It’s like they only have a forgotten password reset. I think that’s because the passwords (or their hashes) are already out there somewhere. Someone who already has your password would be able to retain control of your account if the reset page started with the existing password. [Next page](https://boards.straightdope.com/t/ebay-security-breach-they-are-requesting-that-all-users-change-their-passwords-asap/688929.md?page=2)