In early 2014, attackers gained access to eBay's corporate network by compromising the credentials of a small number of eBay employees. Using those credentials, they were able to access eBay's internal corporate network, move laterally to a database containing customer records, and exfiltrate names, encrypted passwords, email addresses, physical addresses, phone numbers, and dates of birth for 145 million eBay users - the entire active user database. The attackers had network access for approximately 229 days before detection. eBay did not discover the breach through its own monitoring; it was notified by law enforcement.

eBay's handling of the breach notification was widely criticized. The company took several weeks between internal discovery and public notification - notification that, under US state breach notification laws, was meant to occur "in the most expedient time possible." The delay, eBay's public statements attributing the breach to employee credential theft without addressing how that translated to full customer database access, and the absence of any regulatory action despite the scale, made the eBay breach a case study in what inadequate breach response looks like and the regulatory gaps that allow it.

Attack Chain: Employee Credentials to Full Database Access

The attack followed a path that would become increasingly familiar over the following decade. Attackers obtained login credentials for a small number of eBay corporate employees - the exact method has never been definitively disclosed publicly, but contemporaneous reporting and the dwell time suggest either spear-phishing or a prior credential breach that yielded working employee passwords. Those credentials were used to access eBay's internal corporate network.

Once on the corporate network, the attackers moved laterally to reach the database containing user records. The critical question eBay never fully answered publicly was how corporate employee credentials translated into access to a database holding 145 million customer records. In a properly segmented environment, network access as an employee should not provide direct database access to customer data - there should be application-layer controls, database-tier authentication separate from corporate directory credentials, and monitoring for unusual query volumes. The scale of exfiltration (145 million records) suggests either the database access controls were permissive or the attackers spent their 229-day dwell period slowly and quietly extracting data in ways that avoided triggering volume-based alerts.

[TECHNICAL NOTE]
The eBay breach raised important questions about password hashing that were not fully answered. eBay stated that passwords were "encrypted" - a term that generated immediate scrutiny since encryption is reversible while hashing is not, and "encrypted" passwords are therefore recoverable if the encryption key is obtained. Later reporting suggested eBay used bcrypt, which would be appropriate. However, the use of "encrypted" rather than "hashed" in official communications contributed to confusion about user risk. Best practice for breach notification specifically calls for accurate technical characterization of the password protection scheme used, so that recipients can make informed decisions about whether to change their passwords elsewhere. If a company uses bcrypt with a strong cost factor, the practical risk from the password component of a breach is low even if the hash database is stolen. If a company uses MD5 or SHA-1 without salting, password reuse across other services creates immediate risk. eBay's imprecise language made this assessment difficult for affected users. The incident informed guidance from organizations including NIST and PCI DSS on breach notification content requirements.

The 229-Day Dwell Time

The attacker had access to eBay's internal network from approximately February to May 2014 - a period of roughly 229 days (some sources put the compromise starting as early as late 2013). eBay did not detect the intrusion through its own security operations. It was notified by law enforcement that a breach had occurred - the specific law enforcement agency and the circumstances under which they identified the breach were not disclosed. This means that for the entire period of the breach, eBay's security monitoring either was not detecting the attacker's activity or was generating alerts that were not acted upon.

A 229-day dwell time is not unusual in major breaches - Mandiant's annual M-Trends reports from that era documented median attacker dwell times of 200+ days for North America. But the combination of long dwell time, full database exfiltration, and external (law enforcement) notification rather than internal detection illustrated the limits of perimeter-focused security models in which intrusion detection is calibrated primarily to detect external attacks rather than internal lateral movement and data exfiltration.

[WARNING]
eBay's breach notification was criticized on multiple dimensions. First, the timeline: eBay stated it became aware of the breach in early May 2014 and publicly disclosed it on May 21, 2014. States including Connecticut, Illinois, and Florida have breach notification laws requiring notification to affected consumers "in the most expedient time possible" - a period regulators have interpreted as days to weeks, not just notification to state attorneys general. eBay notified state regulators but was slow with direct consumer notification. Second, the notification content: eBay's initial statement told users to "change your password" but did not specify which passwords to prioritize (eBay vs. reused passwords on other services) or provide the specific technical information that would let users assess risk. Third, eBay CEO John Donahoe stated in interviews that the company was initially unsure whether the encrypted database had been accessed - a claim difficult to reconcile with subsequently disclosed facts about the scope of exfiltration. The eBay breach demonstrated that notification laws without enforcement create weak incentives for rapid, transparent disclosure. Despite 145 million records and a months-long notification delay, eBay faced no significant regulatory penalties in the US.

Financial and Regulatory Consequences

The direct regulatory consequences for eBay from the 2014 breach were minimal. No major US regulatory fine was levied. The UK's Information Commissioner's Office investigated and concluded in 2014 that eBay had not been in violation of UK data protection law - a finding that surprised many privacy advocates given the breach's scale and delayed notification. Class action lawsuits were filed in multiple US states but faced uphill battles establishing concrete harm given that the exposed data did not include payment card numbers (eBay processes payments through PayPal, which operates on separate infrastructure).

The practical consequence for users was primarily the risk of credential stuffing. While eBay's own payment data was not in the breach, 145 million users' email/password combinations - even in hashed form - represented a credential database that, if cracked, could be used to test against other services where users had reused passwords. Given password reuse rates estimated at 50-80% among consumers, a significant fraction of those 145 million records represented risk to accounts on other platforms as well.

The longer-term consequence was reputational. eBay's user metrics declined in the period following the breach, though attribution to the breach specifically vs. broader competitive dynamics (Amazon's growth, PayPal's spinoff, mobile commerce shifts) is difficult. eBay subsequently invested significantly in security infrastructure and launched a bug bounty program.

[IOC]
eBay 2014 breach summary: initial access via compromised employee credentials (method undisclosed); lateral movement to customer database. Dwell time: approximately 229 days (late 2013 or February 2014 to May 2014). Detection: not by eBay's internal security - eBay was notified by law enforcement. Data exfiltrated: 145 million customer records including names, encrypted passwords, email addresses, physical addresses, phone numbers, and dates of birth. Payment data: not included (PayPal operated separately). Public disclosure: May 21, 2014. No active financial exploitation of the stolen data was attributed to this breach at the time. Attribution: publicly unattributed; no arrests announced. Regulatory consequence: minimal; no major US regulatory fine. UK ICO found no violation. Class actions filed; settled for minor amounts. Subsequent discovery: users' credentials appeared in later aggregated credential databases used for stuffing attacks. The breach remains in HIBP (Have I Been Pwned) as one of the largest single-incident credential exposures.