In early 2014, attackers gained access to eBay's corporate network by compromising the credentials of a small number of eBay employees. Using those credentials, they were able to access eBay's internal corporate network, move laterally to a database containing customer records, and exfiltrate names, encrypted passwords, email addresses, physical addresses, phone numbers, and dates of birth for 145 million eBay users - the entire active user database. By eBay's account the intrusion took place between late February and early March 2014, and eBay detected it in early May.

eBay's handling of the breach notification was widely criticized. The company took several weeks between internal discovery and public notification - notification that, under US state breach notification laws, was meant to occur "in the most expedient time possible." The delay, eBay's public statements attributing the breach to employee credential theft without addressing how that translated to full customer database access, and the absence of any regulatory action despite the scale, made the eBay breach a case study in what inadequate breach response looks like and the regulatory gaps that allow it.

Attack Chain: Employee Credentials to Full Database Access

The attack followed a path that would become increasingly familiar over the following decade. Attackers obtained login credentials for a small number of eBay corporate employees - the exact method has never been definitively disclosed publicly, but contemporaneous reporting and the dwell time suggest either spear-phishing or a prior credential breach that yielded working employee passwords. Those credentials were used to access eBay's internal corporate network.

Once on the corporate network, the attackers moved laterally to reach the database containing user records. The critical question eBay never fully answered publicly was how corporate employee credentials translated into access to a database holding 145 million customer records. In a properly segmented environment, network access as an employee should not provide direct database access to customer data - there should be application-layer controls, database-tier authentication separate from corporate directory credentials, and monitoring for unusual query volumes. The scale of exfiltration (145 million records) suggests either the database access controls were permissive or the attackers spent their time on the network slowly and quietly extracting data in ways that avoided triggering volume-based alerts.

[TECHNICAL NOTE]
The eBay breach raised important questions about password hashing that were not fully answered. eBay stated that passwords were "encrypted" - a term that generated immediate scrutiny since encryption is reversible while hashing is not, and "encrypted" passwords are therefore recoverable if the encryption key is obtained. Later reporting suggested eBay used bcrypt, which would be appropriate. However, the use of "encrypted" rather than "hashed" in official communications contributed to confusion about user risk. Best practice for breach notification specifically calls for accurate technical characterization of the password protection scheme used, so that recipients can make informed decisions about whether to change their passwords elsewhere. If a company uses bcrypt with a strong cost factor, the practical risk from the password component of a breach is low even if the hash database is stolen. If a company uses MD5 or SHA-1 without salting, password reuse across other services creates immediate risk. eBay's imprecise language made this assessment difficult for affected users. The incident informed guidance from organizations including NIST and PCI DSS on breach notification content requirements.

The Dwell Time

By eBay's account, the compromised employee credentials were used between late February and early March 2014, and the company discovered the intrusion in early May and announced it on May 21 - roughly two to three months later. The sources reviewed do not say how eBay detected it. For that period, eBay's security monitoring either was not detecting the attacker's activity or was generating alerts that were not acted upon.

Dwell times of weeks to months were not unusual in major breaches of that era. But the combination of a long dwell time and full database exfiltration illustrated the limits of perimeter-focused security models in which intrusion detection is calibrated primarily to detect external attacks rather than internal lateral movement and data exfiltration.

[WARNING]
eBay's breach notification was criticized on multiple dimensions. First, the timeline: eBay stated it became aware of the breach in early May 2014 and publicly disclosed it on May 21, 2014. States including Connecticut, Illinois, and Florida have breach notification laws requiring notification to affected consumers "in the most expedient time possible" - a period regulators have interpreted as days to weeks, not just notification to state attorneys general. eBay notified state regulators but was slow with direct consumer notification. Second, the notification content: eBay's initial statement told users to "change your password" but did not specify which passwords to prioritize (eBay vs. reused passwords on other services) or provide the specific technical information that would let users assess risk. Third, eBay CEO John Donahoe stated in interviews that the company was initially unsure whether the encrypted database had been accessed - a claim difficult to reconcile with subsequently disclosed facts about the scope of exfiltration. The eBay breach demonstrated that notification laws without enforcement create weak incentives for rapid, transparent disclosure. Despite 145 million records and a months-long notification delay, eBay faced no significant regulatory penalties in the US.

Financial and Regulatory Consequences

The direct regulatory consequences for eBay from the 2014 breach were minimal. No major US regulatory fine was levied. The UK's Information Commissioner's Office investigated and concluded in 2014 that eBay had not been in violation of UK data protection law - a finding that surprised many privacy advocates given the breach's scale and delayed notification. Class action lawsuits were filed in multiple US states but faced uphill battles establishing concrete harm given that the exposed data did not include payment card numbers (eBay processes payments through PayPal, which operates on separate infrastructure).

The practical consequence for users was primarily the risk of credential stuffing. While eBay's own payment data was not in the breach, 145 million users' email/password combinations - even in hashed form - represented a credential database that, if cracked, could be used to test against other services where users had reused passwords. Given password reuse rates estimated at 50-80% among consumers, a significant fraction of those 145 million records represented risk to accounts on other platforms as well.

The longer-term consequence was reputational. eBay's user metrics declined in the period following the breach, though attribution to the breach specifically vs. broader competitive dynamics (Amazon's growth, PayPal's spinoff, mobile commerce shifts) is difficult. eBay subsequently invested significantly in security infrastructure and launched a bug bounty program.

[IOC]
eBay 2014 breach summary: initial access via compromised employee credentials (method undisclosed); lateral movement to customer database. Dwell time: about two to three months (late February or early March 2014 to early May 2014). Detection: early May 2014; the method was not disclosed. Data exfiltrated: 145 million customer records including names, encrypted passwords, email addresses, physical addresses, phone numbers, and dates of birth. Payment data: not included (PayPal operated separately). Public disclosure: May 21, 2014. No active financial exploitation of the stolen data was attributed to this breach at the time. Attribution: publicly unattributed; no arrests announced. Regulatory consequence: minimal; no major US regulatory fine. UK ICO found no violation. Class actions filed; settled for minor amounts. Subsequent discovery: users' credentials appeared in later aggregated credential databases used for stuffing attacks. The breach remains in HIBP (Have I Been Pwned) as one of the largest single-incident credential exposures.